Executive brief
A vulnerability in the Linux kernel's AppArmor security module can cause a system crash (kernel panic). This occurs when the system processes certain types of network communication handles (file descriptors) during their setup or removal. An exploit would result in a denial-of-service, impacting the availability of the affected server or workstation.
Technical details
A NULL pointer dereference exists in the AppArmor security module within the __unix_needs_revalidation() function. When receiving file descriptors via SCM_RIGHTS, the 'sock' pointer or the 'sock->sk' pointer can be NULL during socket setup or teardown. The function attempts to dereference sock->sk->sk_family without performing necessary NULL checks, leading to a kernel panic. This is a regression introduced in AppArmor 5.0.0 (kernel 6.17+). The issue has been resolved by adding explicit NULL checks for both the socket and its internal kernel structure before accessing the family member.
Affected products
- Linux Linux Kernel 6.17+
Timeline
- 2026-05-27: disclosed
- 2026-05-27: advisory