PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45965 Linux CVE debrief

A NULL pointer dereference vulnerability in the Linux kernel's AppArmor security module can cause a kernel oops when resolving symbolic links to profile rawdata. The issue occurs when the export_binary parameter is disabled at runtime after profiles have been loaded. When such profiles are subsequently replaced, their rawdata is set to NULL, but symbolic link resolution attempts to dereference profile->rawdata->name without checking if rawdata is NULL first. This results in a supervisor read access fault in kernel mode at address 0x88. The vulnerability is triggered through normal filesystem operations such as readlink() on the affected symbolic links in apparmorfs. The fix adds a NULL check before dereferencing rawdata.

Vendor
Linux
Product
Unknown
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-06-16
Advisory published
2026-05-27
Advisory updated
2026-06-16

Who should care

Linux system administrators running AppArmor, security teams managing mandatory access control policies, kernel maintainers, and organizations using AppArmor for container or system security isolation

Technical summary

The vulnerability exists in the AppArmor Linux security module's handling of profile rawdata symbolic links. When the export_binary parameter is disabled at runtime, previously loaded profiles retain their rawdata in apparmorfs with symbolic links pointing to it. Upon profile replacement, rawdata is set to NULL, but rawdata_get_link_base() attempts to access profile->rawdata->name without validation. The crash manifests as a NULL pointer dereference at offset 0x88 (likely the name field offset in the rawdata structure) during supervisor read access in kernel mode. The trigger path involves vfs_readlink() → rawdata_get_link_data() → rawdata_get_link_base(). The fix implements a NULL check for profile->rawdata before dereferencing. Multiple stable kernel commits indicate backporting across kernel versions.

Defensive priority

high

Recommended defensive actions

  • Apply kernel updates containing the referenced stable commits when available for your distribution
  • Monitor for kernel oops messages containing 'rawdata_get_link_base' in system logs
  • Avoid disabling AppArmor's export_binary parameter at runtime if profiles were loaded with it enabled
  • Review AppArmor profile replacement procedures to ensure they occur during maintenance windows
  • Consider enabling kdump to capture crash details if this vulnerability is triggered

Evidence notes

The vulnerability description and kernel oops trace are sourced from the official CVE record published 2026-05-27. Multiple stable kernel commits are referenced indicating backports to various kernel versions. The crash occurs in rawdata_get_link_base.isra.0 with call trace through vfs_readlink and do_readlinkat, confirming the trigger path via readlink system call.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-45965 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-45965

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-45965 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-45965

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/1432ab0774cba43e8111be39989ff226531a9bac

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/19f2e4055626a58842ddec3282ad4465a80c6625

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/1d2b2b58fde9059a488bc25399e6c3d74e9b5548

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/3c36b87fc2a4cf88eadea8cf13923bd2b4f9a3fa

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/6d8c180c825cbc73eeffaa79591f8e142dacae70

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/b25298e89a297c42eb4c4d6f081d60375b820abb

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/df9ac55abd18628bd8cff687ea043660532a3654

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.