PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45848 Linux CVE debrief

A NULL pointer dereference vulnerability exists in the Linux kernel's AppArmor security module, specifically within the `aa_sock_file_perm` function. The flaw occurs during socket setup or teardown when either `sock` or `sock->sk` can be NULL, potentially leading to a kernel oops (crash). This affects af_unix sockets and potentially other socket types. The vulnerability represents a fallback path for older af_unix mediation and other sockets, making it a concern even where newer mediation fixes exist. The issue was resolved by adding proper NULL checks in the affected function.

Vendor
Linux
Product
Unknown
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-05-27
Advisory published
2026-05-27
Advisory updated
2026-05-27

Who should care

Linux system administrators running kernels with AppArmor enabled, particularly those hosting multi-tenant environments, containers, or systems with untrusted local users where kernel stability is critical.

Technical summary

The vulnerability exists in `aa_sock_file_perm()` in the Linux kernel's AppArmor LSM. During socket lifecycle operations, the function may encounter NULL `sock` or `sock->sk` pointers, leading to a NULL pointer dereference and kernel oops. This is particularly relevant for af_unix sockets during setup/teardown phases. The fix adds defensive NULL checks before dereferencing these pointers. Multiple stable kernel branches have received backports of this fix.

Defensive priority

high

Recommended defensive actions

  • Apply kernel updates containing the referenced stable commits for affected kernel versions
  • Review AppArmor policies on systems where kernel updates cannot be immediately applied
  • Monitor kernel logs for oops messages related to AppArmor socket operations
  • Prioritize patching on systems with untrusted local users or container workloads using AppArmor confinement

Evidence notes

The vulnerability description indicates this is a NULL pointer dereference in AppArmor's socket permission handling. Multiple stable kernel commits are referenced, suggesting backports to various kernel versions. The fix addresses a gap where socket structures may be incompletely initialized or partially torn down during permission checks.

Official resources

2026-05-27