CVE-2026-45966: apparmor: fix NULL pointer dereference in __unix_needs_revalidation
In the Linux kernel, the following vulnerability has been resolved:
apparmor: fix NULL pointer dereference in unixneedsrevalidation
When receiving file descriptors via SCMRIGHTS, both the socket pointer and the socket's sk pointer can be NULL during socket setup or teardown, causing NULL pointer dereferences in unixneedsrevalidation().
This is a regression in AppArmor 5.0.0 (kernel 6.17+) where the new unixneedsrevalidation() function was added without proper NULL checks.
The crash manifests as: BUG: kernel NULL pointer dereference, address: 0x0000000000000018 RIP: aafileperm+0xb7/0x3b0 (or +0xbe/0x3b0, +0xc0/0x3e0) Call Trace: apparmorfilereceive+0x42/0x80 securityfilereceive+0x2e/0x50 receivefd+0x1d/0xf0 scmdetachfds+0xad/0x1c0
The function dereferences sock->sk->skfamily without checking if either sock or sock->sk is NULL first.
Add NULL checks for both sock and sock->sk before accessing skfamily.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Modify the __unix_needs_revalidation() function to check whether sock and sock->sk are NULL before dereferencing sk_family; i.e., add explicit NULL checks for both sock and sock->sk to prevent NULL pointer dereference when receiving file descriptors via SCM_RIGHTS.
apparmor: __unix_needs_revalidation (Linux kernel) NULL checks for sock and sock->sk = add
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45966?
The severity of CVE-2026-45966 is medium, with a CVSS score of 5.5.
What impact does CVE-2026-45966 have?
CVE-2026-45966 can lead to a NULL pointer dereference, potentially causing application crashes or instability.
Which software is affected by CVE-2026-45966?
CVE-2026-45966 affects the Linux kernel and the AppArmor software.
How do I fix CVE-2026-45966?
To fix CVE-2026-45966, update your Linux kernel and AppArmor to the latest versions that contain the patch.
What is the cause of CVE-2026-45966?
CVE-2026-45966 is caused by the potential for NULL pointer dereferences during socket setup or teardown when receiving file descriptors via SCM_RIGHTS.