CVE-2026-45884: apparmor: avoid per-cpu hold underflow in aa_get_buffer
In the Linux kernel, the following vulnerability has been resolved:
apparmor: avoid per-cpu hold underflow in aagetbuffer
When aagetbuffer() pulls from the per-cpu list it unconditionally decrements cache->hold. If hold reaches 0 while count is still non-zero, the unsigned decrement wraps to UINTMAX. This keeps hold non-zero for a very long time, so aaputbuffer() never returns buffers to the global list, which can starve other CPUs and force repeated kmalloc(aagpathmax) allocations.
Guard the decrement so hold never underflows.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Implement the resolved logic for AppArmor’s aa_get_buffer() so the unsigned decrement of per-cpu cache->hold cannot wrap to UINT_MAX; ensure aa_put_buffer() can return buffers to the global list instead of starving other CPUs.
Linux kernel (apparmor) aa_get_buffer() per-cpu hold decrement handling = guard decrement so hold never underflows (do not decrement if hold is 0; keep hold non-zero while count is still non-zero)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45884?
CVE-2026-45884 has a medium severity rating of 5.5 on the CVSS scale.
What are the risks associated with CVE-2026-45884?
CVE-2026-45884 involves an integer underflow vulnerability that could lead to a denial of service scenario in the Linux kernel.
How can I mitigate CVE-2026-45884?
To mitigate CVE-2026-45884, ensure that you update to the patched version of the Linux kernel that addresses this vulnerability.
Which software is affected by CVE-2026-45884?
CVE-2026-45884 affects the Linux kernel and specifically the AppArmor feature within it.
What is the nature of the vulnerability in CVE-2026-45884?
CVE-2026-45884 is caused by a per-cpu hold underflow in the aa_get_buffer function of the AppArmor subsystem.