CVE-2026-45965: Linux Kernel Use-After-Free Vulnerability

CVE-2026-45965 Overview

CVE-2026-45965 is a NULL pointer dereference vulnerability in the Linux kernel's AppArmor subsystem. The flaw resides in the handling of profile rawdata when the export_binary parameter is disabled at runtime. Profiles loaded before disabling export_binary retain rawdata references in apparmorfs through symbolic links. When such a profile is replaced, the kernel sets rawdata to NULL but later attempts to dereference profile->rawdata->name during symbolic link resolution. The result is a kernel oops triggered by an unprivileged read operation such as ls traversing apparmorfs. The issue has been resolved in upstream Linux kernel commits.

Critical Impact
An unprivileged local user can trigger a kernel NULL pointer dereference in AppArmor, causing a denial of service on systems running affected Linux kernel builds with AppArmor enabled.

Affected Products

Linux kernel (AppArmor subsystem)
Distributions shipping kernels prior to the fix commits referenced in kernel.org stable trees
Systems with AppArmor enabled and export_binary toggled at runtime

Discovery Timeline

2026-05-27 - CVE-2026-45965 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-45965

Vulnerability Analysis

The vulnerability is a NULL pointer dereference [CWE-476] within the AppArmor Linux Security Module. AppArmor stores profile binary data (rawdata) in apparmorfs when the export_binary parameter is enabled. Each profile directory contains a symbolic link pointing back to its corresponding rawdata entry. Disabling export_binary at runtime does not retroactively remove these symbolic links from previously loaded profiles. When one of those profiles is later replaced, the replacement path sets the profile's rawdata pointer to NULL without cleaning up the dangling links in apparmorfs. A subsequent readlink() against the stale link causes the function rawdata_get_link_base to dereference profile->rawdata->name, producing a NULL pointer access at offset 0x88 and a kernel oops.

Root Cause

The root cause is missing validation of the rawdata pointer before dereferencing its name field inside rawdata_get_link_base.isra.0. The fix introduces an explicit check ensuring rawdata is non-NULL prior to use, preventing the unsafe access when export_binary has been toggled during the lifetime of a profile.

Attack Vector

The vulnerability is reachable locally without elevated privileges. Any process able to traverse apparmorfs and follow symbolic links, such as a user running ls against the policy directory, can trigger the dereference. Exploitation requires that the system administrator previously disabled export_binary at runtime and that an affected profile was subsequently replaced. The result is a kernel oops, which on systems configured with panic_on_oops leads to a full system crash and denial of service.

No verified exploit code is publicly available. See the upstream commits, including Kernel Git Commit 1432ab0 and Kernel Git Commit 19f2e40, for the source-level details of the patched code paths.

Detection Methods for CVE-2026-45965

Indicators of Compromise

Kernel log entries containing BUG: kernel NULL pointer dereference, address: 0000000000000088 accompanied by the call trace rawdata_get_link_base → rawdata_get_link_data → vfs_readlink.
Oops messages referencing __x64_sys_readlink originating from processes accessing paths under /sys/kernel/security/apparmor/policy/.
Unexpected process crashes or system instability shortly after AppArmor profile replacement operations.

Detection Strategies

Monitor dmesg and journalctl -k for oops signatures matching the AppArmor rawdata call path.
Audit AppArmor management activity, particularly changes to the export_binary module parameter via /sys/module/apparmor/parameters/export_binary and subsequent profile reloads using apparmor_parser -r.
Correlate kernel crash telemetry with prior AppArmor configuration changes to identify systems exposed to the unsafe state.

Monitoring Recommendations

Forward kernel ring buffer events to a centralized logging or SIEM platform for cross-host detection of AppArmor oops patterns.
Track userspace processes performing readlink operations within apparmorfs to identify unexpected probing activity.
Alert on host availability anomalies for Linux servers that have AppArmor enabled and recently underwent policy updates.

How to Mitigate CVE-2026-45965

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the kernel.org stable commits as soon as your distribution publishes updated packages.
Avoid toggling the AppArmor export_binary parameter at runtime on unpatched kernels, especially when profiles will subsequently be replaced.
Inventory hosts running AppArmor-enabled kernels and prioritize patching systems where untrusted local users can access apparmorfs.

Patch Information

The fix adds a NULL check on rawdata before dereferencing in rawdata_get_link_base. The change is distributed across multiple stable branches via commits including Kernel Git Commit 1d2b2b5, Kernel Git Commit 3c36b87, Kernel Git Commit 6d8c180, Kernel Git Commit b25298e, Kernel Git Commit df9ac55, and Kernel Git Commit e6b2fc7. Consult your distribution's security tracker for the corresponding package versions.

Workarounds

Leave export_binary in its boot-time configured state and do not modify it at runtime on production systems until the kernel is patched.
Restrict access to apparmorfs paths so that unprivileged users cannot perform readlink operations against affected symbolic links.
Disable panic_on_oops on non-critical systems to prevent a single oops from triggering a full kernel panic while patches are being deployed.

bash

# Verify current export_binary state and avoid runtime changes on unpatched kernels
cat /sys/module/apparmor/parameters/export_binary

# Check running kernel version against your distribution's patched build
uname -r

# Inspect dmesg for the rawdata_get_link_base oops signature
dmesg -T | grep -E 'rawdata_get_link_base|apparmor'