CVE-2026-45966 - Vulnerability Details

- apparmor: fix NULL pointer dereference in __unix_needs_revalidation

Description

In the Linux kernel, the following vulnerability has been resolved:

apparmor: fix NULL pointer dereference in __unix_needs_revalidation

When receiving file descriptors via SCM_RIGHTS, both the socket pointer
and the socket's sk pointer can be NULL during socket setup or teardown,
causing NULL pointer dereferences in __unix_needs_revalidation().

This is a regression in AppArmor 5.0.0 (kernel 6.17+) where the new
__unix_needs_revalidation() function was added without proper NULL checks.

The crash manifests as:
BUG: kernel NULL pointer dereference, address: 0x0000000000000018
RIP: aa_file_perm+0xb7/0x3b0 (or +0xbe/0x3b0, +0xc0/0x3e0)
Call Trace:
apparmor_file_receive+0x42/0x80
security_file_receive+0x2e/0x50
receive_fd+0x1d/0xf0
scm_detach_fds+0xad/0x1c0

The function dereferences sock->sk->sk_family without checking if either
sock or sock->sk is NULL first.

Add NULL checks for both sock and sock->sk before accessing sk_family.

Published: 2026-05-27

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A null pointer dereference was introduced in the AppArmor 5.0.0 Linux kernel module when handling file descriptors sent via SCM_RIGHTS. When a socket or its sock structure is NULL during socket setup or teardown, the __unix_needs_revalidation function dereferences sock->sk->sk_family without a NULL check, causing a kernel BUG and crash. The resulting kernel panic halts services on the affected host, effectively denying availability for processes relying on the kernel.

Affected Systems

Linux kernel installations that include AppArmor version 5.0.0 or later, specifically kernel 6.17 and newer, are impacted. Kernel versions earlier than 6.17 or AppArmor releases prior to 5.0.0 are not affected by this regression.

Risk and Exploitability

The EPSS score is < 1% and the vulnerability is not listed in CISA’s KEV catalog. The description indicates the flaw is triggered when a process receives file descriptors via SCM_RIGHTS and the socket structures are malformed. This scenario requires the attacker to influence socket setup or teardown, which is most likely a local or privileged action. The CVSS score of 5.5 reflects medium severity due to the kernel crash but no confirmed exploits exist at this time.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`88fec3526e84123997ecebd6bb6778eb4ce779b7`	affected	< fea017a7f6abe179decf575a2d8464c74edb3964
`88fec3526e84123997ecebd6bb6778eb4ce779b7`	affected	< e85bc9101afc4202aa2269967ce9d3ffbecd0994
`88fec3526e84123997ecebd6bb6778eb4ce779b7`	affected	< e2938ad00b21340c0362562dfedd7cfec0554d67

Linux

affected

Version	Status	Constraints
`6.17`	affected	—
`0`	unaffected	< 6.17
`6.18.14`	unaffected	≤ 6.18.*
`6.19.4`	unaffected	≤ 6.19.*
`7.0`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[88fec3526e84123997ecebd6bb6778eb4ce779b7,fea017a7f6abe179decf575a2d8464c74edb3964)`	affected	code_commit	—
`[88fec3526e84123997ecebd6bb6778eb4ce779b7,e85bc9101afc4202aa2269967ce9d3ffbecd0994)`	affected	code_commit	—
`[88fec3526e84123997ecebd6bb6778eb4ce779b7,e2938ad00b21340c0362562dfedd7cfec0554d67)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.17`	affected	generic	—
`[0,6.17)`	unaffected	semver	—
`[6.18.14,6.19.0)`	unaffected	semver	—
`[6.19.4,6.20.0)`	unaffected	semver	—
`[7.0,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update the kernel to a newer release that incorporates the null‑check patch for __unix_needs_revalidation.
If the affected applications must use SCM_RIGHTS, restrict or disable file descriptor passing from untrusted peers or apply tighter compartmentalisation policies such as AppArmor profiles or network firewalls.
Reboot the system or reload the kernel to ensure the updated code takes effect.

Generated by OpenCVE AI on June 17, 2026 at 23:57 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Ubuntu USN	USN-8374-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8508-1	Linux kernel (NVIDIA) vulnerabilities

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00121.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/e2938ad00b21340c0362562dfedd7cfec0554d67
https://git.kernel.org/stable/c/e85bc9101afc4202aa2269967ce9d3ffbecd0994
https://git.kernel.org/stable/c/fea017a7f6abe179decf575a2d8464c74edb3964
https://lore.kernel.org/linux-cve-announce/2026052735-CVE-2026-45966-3a47@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-45966
https://www.cve.org/CVERecord?id=CVE-2026-45966

History

Tue, 16 Jun 2026 06:30:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}`

Thu, 28 May 2026 00:15:00 +0000

Type	Values Removed	Values Added
References		https://lore.kernel.org/linux-cve-announce/2026052735-CVE-2026-45966-3a47@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-45966 https://www.cve.org/CVERecord?id=CVE-2026-45966

Wed, 27 May 2026 17:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476

Wed, 27 May 2026 14:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: apparmor: fix NULL pointer dereference in __unix_needs_revalidation When receiving file descriptors via SCM_RIGHTS, both the socket pointer and the socket's sk pointer can be NULL during socket setup or teardown, causing NULL pointer dereferences in __unix_needs_revalidation(). This is a regression in AppArmor 5.0.0 (kernel 6.17+) where the new __unix_needs_revalidation() function was added without proper NULL checks. The crash manifests as: BUG: kernel NULL pointer dereference, address: 0x0000000000000018 RIP: aa_file_perm+0xb7/0x3b0 (or +0xbe/0x3b0, +0xc0/0x3e0) Call Trace: apparmor_file_receive+0x42/0x80 security_file_receive+0x2e/0x50 receive_fd+0x1d/0xf0 scm_detach_fds+0xad/0x1c0 The function dereferences sock->sk->sk_family without checking if either sock or sock->sk is NULL first. Add NULL checks for both sock and sock->sk before accessing sk_family.
Title		apparmor: fix NULL pointer dereference in __unix_needs_revalidation
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/e2938ad00b21340c0362562dfedd7cfec0554d67 https://git.kernel.org/stable/c/e85bc9101afc4202aa2269967ce9d3ffbecd0994 https://git.kernel.org/stable/c/fea017a7f6abe179decf575a2d8464c74edb3964

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-05-27T12:18:24.300Z

Updated: 2026-05-27T12:18:24.300Z

Reserved: 2026-05-13T15:03:33.089Z

Link: CVE-2026-45966

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2026-05-27T14:17:13.460

Modified: 2026-06-17T10:52:48.810

Link: CVE-2026-45966

Redhat

Severity :

Publid Date: 2026-05-27T00:00:00Z

Links: CVE-2026-45966 - Bugzilla

OpenCVE Enrichment

Updated: 2026-06-18T00:00:05Z

Weaknesses

CWE-476
NULL Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object