CVE-2026-45884: Linux Kernel Privilege Escalation Issue

CVE-2026-45884 Overview

CVE-2026-45884 is a Linux kernel vulnerability in the AppArmor Linux Security Module. The flaw resides in the aa_get_buffer() function, which manages per-CPU buffer caches used during policy mediation. When the function pulls a buffer from the per-CPU list, it unconditionally decrements the cache->hold counter. If hold reaches zero while count remains non-zero, the unsigned decrement wraps to UINT_MAX. The wrapped counter keeps hold non-zero for an extended period, preventing aa_put_buffer() from returning buffers to the global list. This starves other CPUs and forces repeated kmalloc(aa_g_path_max) allocations.

Critical Impact
An integer underflow in AppArmor buffer accounting starves CPUs of cached buffers, forcing repeated kernel allocations and degrading system performance.

Affected Products

Linux kernel versions containing the AppArmor per-CPU buffer cache implementation
Distributions shipping affected stable kernel branches referenced in the upstream commits
Systems with AppArmor enabled as the active Linux Security Module

Discovery Timeline

2026-05-27 - CVE-2026-45884 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-45884

Vulnerability Analysis

The vulnerability is an integer underflow in the AppArmor buffer cache accounting logic. AppArmor maintains per-CPU buffer caches to avoid repeated allocations during path mediation. The cache uses two counters: count tracks buffers currently held on the per-CPU list, and hold represents the threshold of buffers the cache should retain locally before returning surplus buffers to the global pool.

The aa_get_buffer() function unconditionally decrements hold whenever it pulls a buffer from the local list. The function never checks whether hold is already zero. Because hold is declared as an unsigned integer, decrementing it past zero causes the value to wrap around to UINT_MAX. This is a classic integer underflow condition.

Once the underflow occurs, the cache believes it must retain an enormous number of buffers locally. The companion function aa_put_buffer() consults hold to decide whether to release buffers back to the global free list. With hold stuck near UINT_MAX, buffers are never released globally. Other CPUs cannot draw from the global pool and must repeatedly call kmalloc(aa_g_path_max) to allocate new buffers on demand.

Root Cause

The root cause is missing bounds checking on an unsigned arithmetic operation [CWE-191]. The code assumes hold will always be non-zero when decremented. The fix guards the decrement so that hold is reduced only when it is greater than zero, preventing underflow.

Attack Vector

This is a resource exhaustion and performance degradation defect rather than a remotely exploitable memory corruption. Triggering the underflow requires workloads that exercise the AppArmor buffer cache imbalance between aa_get_buffer() and aa_put_buffer() calls. Once triggered, the condition persists and degrades performance system-wide by forcing repeated kernel heap allocations on the path mediation hot path.

No verified public exploitation code is available for this vulnerability. The upstream fixes are tracked in kernel commits 202824a1f89a, 4bcddd0f6b2e, 640cf2f09575, and 80c334acc6d0.

Detection Methods for CVE-2026-45884

Indicators of Compromise

Sustained high rates of kmalloc allocations attributed to AppArmor path mediation paths.
Elevated CPU time in aa_get_buffer and related AppArmor functions visible in perf or ftrace profiles.
Unexplained slab allocator churn on systems where AppArmor is active and policies are loaded.

Detection Strategies

Compare running kernel build identifiers against the patched commit hashes listed in the upstream references.
Use bpftrace or ftrace to instrument aa_get_buffer and aa_put_buffer and observe whether buffers stop returning to the global list.
Monitor kernel memory pressure trends correlated with AppArmor policy enforcement workloads.

Monitoring Recommendations

Track slab allocator metrics through /proc/slabinfo for sustained growth tied to AppArmor activity.
Alert on regression in process startup latency on AppArmor-enforced workloads, which depend on path mediation buffers.
Centralize kernel version inventory across the fleet so unpatched hosts are flagged automatically.

How to Mitigate CVE-2026-45884

Immediate Actions Required

Apply the upstream Linux kernel patches that guard the hold decrement in aa_get_buffer().
Update to a distribution kernel that incorporates the fix commits 202824a1f89a, 4bcddd0f6b2e, 640cf2f09575, or 80c334acc6d0.
Inventory all hosts running AppArmor-enabled kernels and prioritize patching of high-throughput systems.

Patch Information

The vulnerability is resolved upstream by guarding the decrement of cache->hold so it never underflows. The fix is available in the kernel commits referenced on git.kernel.org: Kernel Commit 202824a, Kernel Commit 4bcddd0, Kernel Commit 640cf2f, and Kernel Commit 80c334a.

Workarounds

No supported workaround replaces patching, since the defect is internal to kernel buffer accounting.
On non-critical systems, disabling AppArmor avoids the affected code path but removes a security control and is not recommended.
Reboot affected systems after applying the patched kernel to ensure the corrected code path is active.

bash

# Verify your running kernel against patched stable branches
uname -r

# Check whether AppArmor is active
aa-status

# Example: update and reboot on a Debian-based system
sudo apt update && sudo apt install --only-upgrade linux-image-$(uname -r | cut -d- -f3-)
sudo reboot