CVE-2026-45848 Overview
CVE-2026-45848 is a NULL pointer dereference vulnerability in the Linux kernel's AppArmor Linux Security Module (LSM). The flaw resides in the aa_sock_file_perm function, which fails to handle cases where the sock structure or its sk member can be NULL during socket setup or teardown. Triggering this code path produces a kernel oops, resulting in a denial-of-service condition. The issue is the fallback path for older af_unix mediation and other socket families, complementing an earlier fix in __unix_needs_revalidation. Upstream maintainers have committed fixes across multiple stable kernel branches.
Critical Impact
A NULL pointer dereference in the AppArmor socket mediation path can crash the kernel during socket setup or teardown, producing a denial-of-service oops on systems with AppArmor enforcement enabled.
Affected Products
- Linux kernel (mainline) with AppArmor LSM enabled
- Linux stable kernel branches prior to the commits referenced below
- Distributions shipping AppArmor-enforced kernels (Ubuntu, Debian, openSUSE, and derivatives)
Discovery Timeline
- 2026-05-27 - CVE-2026-45848 published to NVD
- 2026-05-27 - Last updated in NVD database
Technical Details for CVE-2026-45848
Vulnerability Analysis
The vulnerability exists in the AppArmor LSM hook aa_sock_file_perm, which mediates file-style operations on socket file descriptors. AppArmor consults sock->sk to evaluate policy decisions against the kernel socket. During socket setup or teardown, the kernel can transiently present a state where either the sock pointer or its embedded sk pointer is NULL. The hook did not validate these pointers before dereferencing them, so policy evaluation against a half-initialized or torn-down socket triggers an oops. The crash falls under [CWE-476] NULL Pointer Dereference and produces a kernel-level denial of service.
Root Cause
The root cause is missing NULL-pointer validation in aa_sock_file_perm before it accesses sock->sk and downstream fields. A prior commit addressed the same class of bug for af_unix sockets in __unix_needs_revalidation under the newer mediation path. However, the older AppArmor mediation path and non-af_unix socket families continued to rely on aa_sock_file_perm without equivalent guards. The fix adds explicit NULL checks so the hook returns safely when sockets are not fully constructed.
Attack Vector
The attack vector is local. A process operating on a socket file descriptor while the socket is being initialized or destroyed can race the AppArmor mediation hook, triggering the NULL dereference. Exploitation does not yield code execution. The vulnerability manifests as a kernel oops, degrading availability on systems where AppArmor policy is actively enforced. See the kernel git commit log for the fix details.
Detection Methods for CVE-2026-45848
Indicators of Compromise
- Kernel oops messages in dmesg or /var/log/kern.log referencing aa_sock_file_perm in the call trace
- System crashes or service interruptions correlated with socket-heavy workloads on AppArmor-enabled hosts
- Repeated kernel panics tied to af_unix or other socket family teardown sequences
Detection Strategies
- Inventory Linux hosts running AppArmor-enforced kernels and compare installed kernel versions against the fixed stable branches referenced in the kernel.org commits.
- Aggregate kernel ring buffer output centrally and alert on stack traces containing aa_sock_file_perm or apparmor symbols.
- Monitor host availability metrics for unexpected reboots on systems running AppArmor policy enforcement.
Monitoring Recommendations
- Forward dmesg, journalctl -k, and kdump artifacts to a central log platform for kernel oops correlation.
- Track AppArmor profile load events and socket-creation telemetry on production fleets.
- Build dashboards that count kernel oopses per host and trigger alerts when the rate exceeds baseline.
How to Mitigate CVE-2026-45848
Immediate Actions Required
- Identify all Linux hosts with AppArmor enabled by checking /sys/module/apparmor/parameters/enabled and aa-status.
- Apply distribution kernel updates that incorporate the upstream fix commits referenced in the NVD entry.
- Schedule rolling reboots after kernel package upgrades to load the patched kernel image.
Patch Information
The fix has been committed across multiple stable Linux kernel branches. Reference commits include 00b6765, 0dc19bc, 3852eb9, 5121b72, 68538ec, 8a0ededb, c11b7c3, and ccb66a3. Consume the fixed kernel through your distribution's package repository.
Workarounds
- Where patching cannot be completed immediately, evaluate disabling AppArmor enforcement temporarily on non-production hosts, accepting the loss of LSM protection until a fix is applied.
- Restrict local access to multi-tenant systems to reduce the chance of triggering the race during socket teardown.
- Enable kdump and crash collection so any oops can be analyzed and attributed quickly.
# Verify AppArmor status and current kernel version
uname -r
sudo aa-status
cat /sys/module/apparmor/parameters/enabled
# Apply distribution kernel updates (Debian/Ubuntu example)
sudo apt update && sudo apt upgrade -y linux-image-$(uname -r | cut -d- -f3-)
sudo reboot
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
