Executive brief
A vulnerability in the Linux kernel's AppArmor security module can cause the system to crash (kernel oops) when certain security profiles are updated. This occurs when a specific configuration for exporting binary data is disabled while the system is running. An attacker or a system error could trigger this crash, leading to a denial of service where the operating system stops functioning.
Technical details
A NULL pointer dereference exists in the AppArmor security module within the Linux kernel. The issue occurs in the 'rawdata_get_link_base' function in 'security/apparmor/apparmorfs.c'. When the 'export_binary' parameter is disabled at runtime, profiles loaded prior to this change still maintain symbolic links to rawdata in apparmorfs. If such a profile is subsequently replaced, its rawdata pointer is set to NULL. Attempting to resolve the existing symbolic links then leads to a dereference of 'profile->rawdata->name' while 'profile->rawdata' is NULL, causing a kernel oops. The fix introduces a check to ensure 'profile->rawdata' is valid before dereferencing.
Affected products
- Linux Linux kernel 6.19.0-rc7+; fixed in 1432ab0774cba43e8111be39989ff226531a9bac and others
Timeline
- 2026-01-29: patched: Initial patch authored by Georgia Garcia
- 2026-05-27: disclosed: CVE-2026-45965 published
References
- https://git.kernel.org/stable/c/1432ab0774cba43e8111be39989ff226531a9bac
- https://git.kernel.org/stable/c/19f2e4055626a58842ddec3282ad4465a80c6625
- https://git.kernel.org/stable/c/1d2b2b58fde9059a488bc25399e6c3d74e9b5548
- https://git.kernel.org/stable/c/3c36b87fc2a4cf88eadea8cf13923bd2b4f9a3fa
- https://git.kernel.org/stable/c/6d8c180c825cbc73eeffaa79591f8e142dacae70
- https://git.kernel.org/stable/c/b25298e89a297c42eb4c4d6f081d60375b820abb
- https://git.kernel.org/stable/c/df9ac55abd18628bd8cff687ea043660532a3654