UBUNTU-CVE-2026-45966: Null Pointer Dereference

Published May 27, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix NULL pointer dereference in unixneedsrevalidation When receiving file descriptors via SCMRIGHTS, both the socket pointer and the socket's sk pointer can be NULL during socket setup or teardown, causing NULL pointer dereferences in unixneedsrevalidation(). This is a regression in AppArmor 5.0.0 (kernel 6.17+) where the new unixneedsrevalidation() function was added without proper NULL checks. The crash manifests as: BUG: kernel NULL pointer dereference, address: 0x0000000000000018 RIP: aafileperm+0xb7/0x3b0 (or +0xbe/0x3b0, +0xc0/0x3e0) Call Trace: apparmorfilereceive+0x42/0x80 securityfilereceive+0x2e/0x50 receivefd+0x1d/0xf0 scmdetachfds+0xad/0x1c0 The function dereferences sock->sk->skfamily without checking if either sock or sock->sk is NULL first. Add NULL checks for both sock and sock->sk before accessing skfamily.

Affected Software

113 affected componentsFixes available

ubuntu/linux-hwe-edge*

ubuntu/linux-aws-5.0*

ubuntu/linux-aws-5.3*

ubuntu/linux-azure*

ubuntu/linux-azure-5.3*

ubuntu/linux-azure-edge*

ubuntu/linux-gcp*

ubuntu/linux-gcp-5.3*

ubuntu/linux-gke-4.15*

ubuntu/linux-gke-5.4*

ubuntu/linux-gkeop-5.4*

ubuntu/linux-hwe*

ubuntu/linux-hwe-edge*

ubuntu/linux-oem*

ubuntu/linux-oracle-5.0*

ubuntu/linux-oracle-5.3*

ubuntu/linux-aws-5.11*

ubuntu/linux-aws-5.13*

ubuntu/linux-aws-5.8*

ubuntu/linux-azure-5.11*

ubuntu/linux-azure-5.13*

ubuntu/linux-azure-5.8*

ubuntu/linux-azure-fde*

ubuntu/linux-gcp-5.11*

ubuntu/linux-gcp-5.13*

ubuntu/linux-gcp-5.8*

ubuntu/linux-gke*

ubuntu/linux-gke-5.15*

ubuntu/linux-gkeop*

ubuntu/linux-gkeop-5.15*

ubuntu/linux-hwe-5.11*

ubuntu/linux-hwe-5.13*

ubuntu/linux-hwe-5.8*

ubuntu/linux-intel-5.13*

ubuntu/linux-oem-5.10*

ubuntu/linux-oem-5.13*

ubuntu/linux-oem-5.6*

ubuntu/linux-oracle-5.11*

ubuntu/linux-oracle-5.13*

ubuntu/linux-oracle-5.8*

ubuntu/linux-raspi2*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.11*

ubuntu/linux-riscv-5.8*

ubuntu/linux-allwinner-5.19*

ubuntu/linux-aws-5.19*

ubuntu/linux-aws-6.2*

ubuntu/linux-aws-6.5*

ubuntu/linux-azure-5.19*

ubuntu/linux-azure-6.2*

ubuntu/linux-azure-6.5*

ubuntu/linux-azure-fde-5.19*

ubuntu/linux-azure-fde-6.2*

ubuntu/linux-gcp-5.19*

ubuntu/linux-gcp-6.2*

ubuntu/linux-gcp-6.5*

ubuntu/linux-hwe-5.19*

ubuntu/linux-hwe-6.2*

ubuntu/linux-hwe-6.5*

ubuntu/linux-intel-iot-realtime*

ubuntu/linux-lowlatency-hwe-5.19*

ubuntu/linux-lowlatency-hwe-6.2*

ubuntu/linux-lowlatency-hwe-6.5*

ubuntu/linux-nvidia-6.2*

ubuntu/linux-nvidia-6.5*

ubuntu/linux-oem-5.17*

ubuntu/linux-oem-6.0*

ubuntu/linux-oem-6.1*

ubuntu/linux-oem-6.5*

ubuntu/linux-oracle-6.5*

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.19*

ubuntu/linux-riscv-6.5*

ubuntu/linux-starfive-5.19*

ubuntu/linux-starfive-6.2*

ubuntu/linux-starfive-6.5*

ubuntu/linux-aws-6.14*

ubuntu/linux-aws-6.17<6.17.0-1017.17~24.04.1

6.17.0-1017.17~24.04.1

ubuntu/linux-azure-6.11*

ubuntu/linux-azure-6.17<6.17.0-1015.15~24.04.1

6.17.0-1015.15~24.04.1

ubuntu/linux-gcp-6.11*

ubuntu/linux-gcp-6.14*

ubuntu/linux-gcp-6.17<6.17.0-1018.19~24.04.1

6.17.0-1018.19~24.04.1

ubuntu/linux-hwe-6.11*

ubuntu/linux-hwe-6.14*

ubuntu/linux-hwe-6.17<6.17.0-29.29~24.04.1

6.17.0-29.29~24.04.1

ubuntu/linux-lowlatency-hwe-6.11*

ubuntu/linux-nvidia-6.11*

ubuntu/linux-nvidia-6.17<6.17.0-1026.26

6.17.0-1026.26

ubuntu/linux-oem-6.11*

ubuntu/linux-oem-6.14*

ubuntu/linux-oem-6.17<6.17.0-1023.23

6.17.0-1023.23

ubuntu/linux-oem-6.8*

ubuntu/linux-oracle-6.14*

ubuntu/linux-oracle-6.17<6.17.0-1014.14~24.04.1

6.17.0-1014.14~24.04.1

ubuntu/linux-raspi-realtime*

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-6.14*

ubuntu/linux-riscv-6.17<6.17.0-29.29.1~24.04.1

6.17.0-29.29.1~24.04.1

ubuntu/linux-realtime-6.14*

ubuntu/linux-realtime-6.17<6.17.0-1013.15~24.04.1

6.17.0-1013.15~24.04.1

ubuntu/linux<6.17.0-29.29

6.17.0-29.29

ubuntu/linux-aws<6.17.0-1015.15

6.17.0-1015.15

ubuntu/linux-azure<6.17.0-1015.15

6.17.0-1015.15

ubuntu/linux-azure-fde*

ubuntu/linux-gcp<6.17.0-1018.19

6.17.0-1018.19

ubuntu/linux-oracle<6.17.0-1014.14

6.17.0-1014.14

ubuntu/linux-raspi<6.17.0-1017.17

6.17.0-1017.17

ubuntu/linux-realtime<6.17.0-1013.15

6.17.0-1013.15

ubuntu/linux-riscv<6.17.0-29.29.1

6.17.0-29.29.1

ubuntu/linux-vmware*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/linux-aws-6.17 to a version that resolves this vulnerability.
Fixed in 6.17.0-1017.17~24.04.1
Upgrade
Upgrade ubuntu/linux-azure-6.17 to a version that resolves this vulnerability.
Fixed in 6.17.0-1015.15~24.04.1
Upgrade
Upgrade ubuntu/linux-gcp-6.17 to a version that resolves this vulnerability.
Fixed in 6.17.0-1018.19~24.04.1
Upgrade
Upgrade ubuntu/linux-hwe-6.17 to a version that resolves this vulnerability.
Fixed in 6.17.0-29.29~24.04.1
Upgrade
Upgrade ubuntu/linux-nvidia-6.17 to a version that resolves this vulnerability.
Fixed in 6.17.0-1026.26
Upgrade
Upgrade ubuntu/linux-oem-6.17 to a version that resolves this vulnerability.
Fixed in 6.17.0-1023.23
Upgrade
Upgrade ubuntu/linux-oracle-6.17 to a version that resolves this vulnerability.
Fixed in 6.17.0-1014.14~24.04.1
Upgrade
Upgrade ubuntu/linux-riscv-6.17 to a version that resolves this vulnerability.
Fixed in 6.17.0-29.29.1~24.04.1
Upgrade
Upgrade ubuntu/linux-realtime-6.17 to a version that resolves this vulnerability.
Fixed in 6.17.0-1013.15~24.04.1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 6.17.0-29.29
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 6.17.0-1015.15
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 6.17.0-1015.15
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 6.17.0-1018.19
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 6.17.0-1014.14
Upgrade
Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.
Fixed in 6.17.0-1017.17
Upgrade
Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.
Fixed in 6.17.0-1013.15
Upgrade
Upgrade ubuntu/linux-riscv to a version that resolves this vulnerability.
Fixed in 6.17.0-29.29.1
Compensating control
In AppArmor's __unix_needs_revalidation(), add NULL checks for both sock and sock->sk before accessing sk_family.

Event History

May 27, 2026

CVE Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which systems are exposed to this issue?

The issue affects the listed Ubuntu kernel packages: linux-riscv, linux-realtime, linux-hwe-edge, linux-azure, linux-gcp, linux-azure-fde, linux-aws-5.0, and linux-aws-5.3. It is a regression introduced with AppArmor 5.0.0 in kernel 6.17 and later.

What must occur for the kernel crash to be triggered?

A process must receive file descriptors over a UNIX socket using SCM_RIGHTS while the associated socket or its sk pointer is NULL during socket setup or teardown. The vulnerable AppArmor revalidation path then dereferences sock->sk->sk_family without checking those pointers.

What is the practical impact?

Successful triggering causes a kernel NULL pointer dereference in the AppArmor file-receive path, resulting in a crash. The supplied severity vector indicates local access, low attack complexity, and low privileges are required, with high availability impact.

How can I recognize that this issue has occurred?

Kernel logs may show a BUG: kernel NULL pointer dereference at address 0x0000000000000018, with aa_file_perm in the instruction pointer and a call trace including apparmor_file_receive, security_file_receive, receive_fd, and scm_detach_fds.

UBUNTU-CVE-2026-45966: Null Pointer Dereference

Affected Software

Remediation

Event History

Frequently Asked Questions

Which systems are exposed to this issue?

What must occur for the kernel crash to be triggered?

What is the practical impact?

How can I recognize that this issue has occurred?

Company

Resources

Contact

Frequently Asked Questions

Which systems are exposed to this issue?

What must occur for the kernel crash to be triggered?

What is the practical impact?

How can I recognize that this issue has occurred?