Linux Kernel CVE-2026-45848

The vulnerability resides in AppArmor's Linux Security Module (LSM) hook aa_sock_file_perm(), called by the kernel to enforce MAC policy on socket file operations. During kernel socket lifecycle transitions - specifically the setup or teardown phases - the sock pointer and its embedded sk (sock_kernel) field can transiently be NULL. CWE-476 (NULL Pointer Dereference) identifies the root cause: the code dereferences these pointers without first validating non-NULL state. A prior fix for __unix_needs_revalidation proved this race is real for AF_UNIX sockets under newer mediation; this CVE closes the same gap in the older mediation fallback path, which also handles all non-AF_UNIX socket families. The fix was introduced as commit 56974a6fcfef69ee0825bd66ed13e92070ac5224 and backported across seven stable kernel branches. CPE: cpe:2.3:o:linux:linux_kernel:* across multiple stable series.