Linux Kernel CVE-2026-45893

Exploitation requires local access and the ability to load an AppArmor policy into the kernel - i.e., AppArmor must be enabled and the attacker must be able to submit a crafted (possibly unaligned, malformed) policy blob to the apparmorfs load/replace interface, an operation that normally demands CAP_MAC_ADMIN or a configuration (such as unprivileged user namespaces) that permits profile manipulation. Limiting factors: no remote vector (AV:L), no user interaction needed, but the practical privilege bar is the capability to load profiles, so default systems where only root/init loads AppArmor policy are not exposed to ordinary unprivileged users. Systems with AppArmor disabled are unaffected, and the impact is memory disclosure/crash rather than code execution.

Signals are mostly aligned toward a real-but-modest priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H, base 7.1) indicates local access with low privileges and no user interaction, yielding high confidentiality (kernel memory disclosure) and high availability (crash/DoS) impact but no integrity impact - consistent with an out-of-bounds read rather than code execution. EPSS is very low at 0.02% (5th percentile), and the vulnerability is NOT on the CISA KEV list and has no identified public POC, so there is no evidence of active or imminent widespread exploitation. The key practical limiter not fully captured by PR:L is that loading an AppArmor policy normally requires CAP_MAC_ADMIN (effectively a privileged operation), which substantially narrows the realistic attacker population to those who can already load profiles or who operate in configurations permitting unprivileged/user-namespace policy loading - verify this against your deployment. Net: patch in routine maintenance cadence; this is not a drop-everything emergency but is a legitimate local kernel memory-disclosure/DoS bug.

A local user or compromised low-privileged process that is able to load or replace an AppArmor policy crafts a malicious policy blob with manipulated length/offset fields and unaligned layout, then submits it through the apparmorfs load interface. During table construction the kernel reads beyond the intended buffer, disclosing adjacent kernel memory (potentially defeating KASLR or leaking secrets) or triggering a crash/denial of service. No public POC is identified, and successful exploitation depends on the attacker having the privilege to load AppArmor profiles.