CVE-2026-45966: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-45966 Overview

CVE-2026-45966 is a NULL pointer dereference vulnerability in the Linux kernel's AppArmor security module. The flaw exists in the __unix_needs_revalidation() function, which was introduced in AppArmor 5.0.0 starting with kernel 6.17. When a process receives file descriptors over Unix domain sockets via SCM_RIGHTS, AppArmor dereferences sock->sk->sk_family without first verifying that either sock or sock->sk is non-NULL. During socket setup or teardown, both pointers can be NULL, triggering a kernel crash inside aa_file_perm() via apparmor_file_receive().

Critical Impact
Local unprivileged processes can trigger a kernel NULL pointer dereference through normal SCM_RIGHTS file descriptor passing, causing a denial of service on AppArmor-enabled systems running kernel 6.17 or later.

Affected Products

Linux kernel 6.17 and later with AppArmor 5.0.0
Distributions enabling AppArmor LSM on affected kernel versions
Systems using Unix domain socket file descriptor passing under AppArmor confinement

Discovery Timeline

2026-05-27 - CVE-2026-45966 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-45966

Vulnerability Analysis

The regression sits in AppArmor's LSM hook for file descriptor reception. When the kernel processes SCM_RIGHTS ancillary data attached to a Unix domain socket message, it invokes security_file_receive(), which dispatches to apparmor_file_receive() and then to aa_file_perm(). AppArmor 5.0.0 added __unix_needs_revalidation() to determine whether a passed file descriptor requires policy revalidation based on the socket family.

The new function reads sock->sk->sk_family directly. The Unix socket subsystem, however, can present file structures whose backing struct socket or its sk member are NULL during connection setup or teardown windows. Dereferencing those pointers produces a kernel oops at offset 0x18, which corresponds to the sk_family field within struct sock.

Root Cause

The defect is a missing NULL check [CWE-476]. __unix_needs_revalidation() assumes that any file passed through SCM_RIGHTS has a fully initialized socket and a non-NULL sk pointer. That assumption does not hold across the full lifecycle of a Unix socket. The fix adds explicit NULL checks for both sock and sock->sk before reading sk_family.

Attack Vector

Exploitation requires only local code execution with the ability to create Unix domain sockets and pass file descriptors. An attacker races socket teardown against SCM_RIGHTS delivery so that the receiving side observes a transient state with sock or sock->sk set to NULL. The resulting crash manifests as:

BUG: kernel NULL pointer dereference, address: 0x0000000000000018
RIP: aa_file_perm+0xb7/0x3b0
Call Trace:
 apparmor_file_receive+0x42/0x80
 security_file_receive+0x2e/0x50
 receive_fd+0x1d/0xf0
 scm_detach_fds+0xad/0x1c0

No verified public proof-of-concept is available. The vulnerability mechanism is described in the upstream kernel commits referenced in the Kernel Git Commit Change.

Detection Methods for CVE-2026-45966

Indicators of Compromise

Kernel oops messages referencing aa_file_perm, apparmor_file_receive, or __unix_needs_revalidation in dmesg or /var/log/kern.log
Unexpected kernel panics on systems running kernel 6.17 or later with AppArmor enabled
Crash signatures showing faulting address 0x0000000000000018 within the AppArmor file LSM path

Detection Strategies

Inventory hosts running kernel 6.17+ and confirm whether AppArmor 5.0.0 is the active LSM via cat /sys/kernel/security/lsm
Aggregate kernel ring buffer output centrally and alert on NULL pointer dereference events containing apparmor_file_receive in the call trace
Correlate kernel crash telemetry with processes invoking sendmsg() with SCM_RIGHTS ancillary data immediately prior to the fault

Monitoring Recommendations

Forward kern.log and journalctl -k output to a centralized log platform with retention sufficient to investigate intermittent crashes
Track host reboot frequency and unscheduled kernel panics on AppArmor-protected workloads
Enable kdump to capture vmcore artifacts for post-crash analysis of socket state at the time of fault

How to Mitigate CVE-2026-45966

Immediate Actions Required

Apply the upstream Linux kernel patches that introduce NULL checks in __unix_needs_revalidation() and reboot affected systems
Identify all kernel 6.17+ hosts with AppArmor active and prioritize them for patching
Restrict untrusted local code execution on systems that cannot be patched immediately

Patch Information

The fix adds NULL checks for both sock and sock->sk before accessing sk_family in __unix_needs_revalidation(). The upstream remediation is available in the following commits: Kernel Git Commit Change, Kernel Git Commit Update, and Kernel Git Commit Modification. Distribution kernels should pick up the change in their next stable release.

Workarounds

Temporarily disable the AppArmor LSM at boot using apparmor=0 on the kernel command line where security policy allows
Downgrade to a kernel version prior to 6.17 that does not contain the regressed __unix_needs_revalidation() function
Limit local user access on multi-tenant hosts to reduce the population of processes that can trigger the race

bash

# Verify kernel version and active LSMs before patching
uname -r
cat /sys/kernel/security/lsm

# After installing the patched kernel package, reboot
sudo reboot

# Confirm the patched kernel is running
uname -r
dmesg | grep -i apparmor