Skip to main content

Linux Kernel CVE-2026-45965

| EUVDEUVD-2026-32249 MEDIUM
NULL Pointer Dereference (CWE-476)
2026-05-27 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-8pgm-3pm8-2qcc
Denial Of Service Linux Null Pointer Dereference Debian Ubuntu Red Hat Suse
5.5
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Obtain local low-privilege shell
  2. Delivery
    Confirm export_binary disabled and profile replacement occurred
  3. Exploit
    Execute readlink on rawdata symlink in apparmorfs
  4. Execution
    rawdata_get_link_base dereferences NULL profile->rawdata
  5. Persist
    Kernel NULL pointer oops at address 0x88
  6. Impact
    System crash / full availability loss

Vulnerability Assessment

Weakness
CWE
CWE-476
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK

1 technique across 1 tactic: Impact

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Three specific conditions must all be present: (1) The export_binary AppArmor kernel parameter must have been disabled at runtime after boot - this is a non-default administrative action, as export_binary defaults to enabled; (2) at least one AppArmor profile must have been loaded while export_binary was still enabled, so that rawdata and its symlink exist in apparmorfs; (3) that profile must subsequently be replaced (e.g., via apparmor_parser -r), which sets profile->rawdata to NULL while the symlink in the policy directory remains. Once these admin-triggered preconditions exist, any local user with PR:L (standard shell access) can trigger the crash by reading the rawdata symlink via the readlink syscall - confirmed by the call trace showing __x64_sys_readlink → do_readlinkat → vfs_readlink → rawdata_get_link_data → rawdata_get_link_base. Exploitation is constrained to denial-of-service only; there is no code execution, information disclosure, or integrity impact. Remote exploitation is not possible due to AV:L.
Impact

The NVD-assigned CVSS 3.1 score of 5.5 (Medium, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) correctly captures the local, low-privilege attack path with high availability impact and no confidentiality or integrity consequence. However, AC:L in the NVD vector arguably understates the preconditions: exploitation requires that an administrator has disabled export_binary at runtime and has subsequently replaced an AppArmor profile - both actions beyond a typical local attacker's control, which would support AC:H under a stricter reading. EPSS at 0.02% (7th percentile) confirms negligible exploitation probability in the wild, consistent with the high-specificity precondition set. The vulnerability is not listed in CISA KEV and no public exploit code has been identified at time of analysis. In practice, risk is highest in environments where AppArmor profiles are actively managed and export_binary is toggled dynamically (e.g., automated policy deployment pipelines), where a local user could reliably trigger the crash. For static, default-configuration deployments, real-world risk is very low despite the kernel-crash severity.
Exploit ScenarioDerived

A local attacker with a standard user account on a Linux system where an administrator has disabled export_binary at runtime and subsequently replaced an AppArmor profile executes readlink or ls -l against the rawdata symlink under /sys/kernel/security/apparmor/policy/. The kernel's rawdata_get_link_base function attempts to dereference profile->rawdata->name with rawdata now NULL, producing a kernel oops at address 0x88 and crashing the system. No exploit code beyond the naturally triggerable syscall (readlink/do_readlinkat) is required, and the crash is confirmed by the full oops trace published in the kernel commit.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 16, 2026

Kernel NULL pointer dereference in the Linux AppArmor security module allows a local low-privileged user to crash the system by reading an apparmorfs symbolic link under a specific runtime configuration sequence. The flaw exists in rawdata_get_link_base, where profile->rawdata->name is dereferenced without first verifying that rawdata is non-NULL after a profile replacement clears it. No public exploit exists and EPSS stands at 0.02%, though the crash is fully reproducible from the conditions documented in the commit description.

RemediationAI

Update the Linux kernel to a patched stable release for your branch: 5.10.252 or later, 5.15.202 or later, 6.1.165 or later, 6.6.128 or later, 6.12.75 or later, 6.18.14 or later, or 6.19.4 or later. Upstream patch commits are available at git.kernel.org for all affected stable series (b25298e89a297c42eb4c4d6f081d60375b820abb, 1432ab0774cba43e8111be39989ff226531a9bac, 19f2e4055626a58842ddec3282ad4465a80c6625, 6d8c180c825cbc73eeffaa79591f8e142dacae70, e6b2fc7e34d4e7ca6b8598c33a3d45d59e455d8d, 3c36b87fc2a4cf88eadea8cf13923bd2b4f9a3fa, df9ac55abd18628bd8cff687ea043660532a3654, 1d2b2b58fde9059a488bc25399e6c3d74e9b5548). If immediate patching is not possible, as a compensating control avoid disabling export_binary at runtime on production systems where AppArmor profiles are actively replaced; keeping export_binary enabled eliminates the NULL-setting path during profile replacement. Alternatively, restrict local user read access to /sys/kernel/security/apparmor/policy/ via filesystem namespace controls or seccomp policy filtering readlink syscalls against apparmorfs paths - note this may break legitimate AppArmor management tools such as aa-status and libapparmor.

Affected VersionsENISA

Linux 1180b4c757aab5506f1be367000364dd5cf5cd02 <b25298e89a297c42eb4c4d6f081d60375b820abb
Linux patch: 0
Linux patch: 7.0
Linux 1180b4c757aab5506f1be367000364dd5cf5cd02 <1432ab0774cba43e8111be39989ff226531a9bac
Linux patch: 6.12.75
Linux 1180b4c757aab5506f1be367000364dd5cf5cd02 <e6b2fc7e34d4e7ca6b8598c33a3d45d59e455d8d
Linux patch: 6.18.14
Linux 1180b4c757aab5506f1be367000364dd5cf5cd02 <df9ac55abd18628bd8cff687ea043660532a3654
Linux 1180b4c757aab5506f1be367000364dd5cf5cd02 <6d8c180c825cbc73eeffaa79591f8e142dacae70
Linux patch: 6.6.128
Linux 1180b4c757aab5506f1be367000364dd5cf5cd02 <19f2e4055626a58842ddec3282ad4465a80c6625
Linux patch: 6.1.165
Linux 1180b4c757aab5506f1be367000364dd5cf5cd02 <1d2b2b58fde9059a488bc25399e6c3d74e9b5548
Linux 4.17
Linux 1180b4c757aab5506f1be367000364dd5cf5cd02 <3c36b87fc2a4cf88eadea8cf13923bd2b4f9a3fa
Linux patch: 6.19.4
Linux patch: 5.15.202
Linux patch: 5.10.252

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

AppArmor is a Linux Security Module (LSM) providing mandatory access control via security profiles managed through the AppArmor filesystem (apparmorfs) at /sys/kernel/security/apparmor/. The vulnerability resides in rawdata_get_link_base (security/apparmor/apparmorfs.c), which resolves symbolic links pointing to the raw binary policy data stored per-profile. When the export_binary kernel parameter is disabled at runtime, profiles that were already loaded retain their rawdata in apparmorfs including a symlink from the policy directory. Upon a subsequent profile replacement, profile->rawdata is zeroed, but the link resolver does not guard against this NULL before accessing profile->rawdata->name. The crash occurs at offset 0x88 from the NULL address, consistent with the name field offset within the rawdata structure. CWE-476 (NULL Pointer Dereference) is the confirmed root cause; the fix is a single NULL check added prior to dereference. Affected CPE: cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*, covering kernels from the introducing commit (1180b4c757aab5506f1be367000364dd5cf5cd02, first appearing in Linux 4.17) through multiple stable series.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI 4.7 MEDIUM

AC:H reflects the requirement for two prior administrative actions (disabling export_binary at runtime then replacing a profile) beyond the attacker's control; no C or I impact applies.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE MEDIUM

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
CVSS changed
Jun 16, 2026 - 02:52 NVD
5.5 (MEDIUM)
Patch available
May 27, 2026 - 19:46 EUVD
CVE Published
May 27, 2026 - 14:17 nvd
MEDIUM 5.5
CVE Published
May 27, 2026 - 14:17 nvd
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

apparmor: fix invalid deref of rawdata when export_binary is unset

If the export_binary parameter is disabled on runtime, profiles that were loaded before that will still have their rawdata stored in apparmorfs, with a symbolic link to the rawdata on the policy directory. When one of those profiles are replaced, the rawdata is set to NULL, but when trying to resolve the symbolic links to rawdata for that profile, it will try to dereference profile->rawdata->name when profile->rawdata is now NULL causing an oops. Fix it by checking if rawdata is set.

[ 168.653080] BUG: kernel NULL pointer dereference, address: 0000000000000088 [ 168.657420] #PF: supervisor read access in kernel mode [ 168.660619] #PF: error_code(0x0000) - not-present page [ 168.663613] PGD 0 P4D 0 [ 168.665450] Oops: Oops: 0000 [#1] SMP NOPTI [ 168.667836] CPU: 1 UID: 0 PID: 1729 Comm: ls Not tainted 6.19.0-rc7+ #3 PREEMPT(voluntary) [ 168.672308] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 168.679327] RIP: 0010:rawdata_get_link_base.isra.0+0x23/0x330 [ 168.682768] Code: 90 90 90 90 90 90 90 0f 1f 44 00 00 55 48 89 e5 41 57 41 56 41 55 41 54 53 48 83 ec 18 48 89 55 d0 48 85 ff 0f 84 e3 01 00 00 <48> 83 3c 25 88 00 00 00 00 0f 84 d4 01 00 00 49 89 f6 49 89 cc e8 [ 168.689818] RSP: 0018:ffffcdcb8200fb80 EFLAGS: 00010282 [ 168.690871] RAX: ffffffffaee74ec0 RBX: 0000000000000000 RCX: ffffffffb0120158 [ 168.692251] RDX: ffffcdcb8200fbe0 RSI: ffff88c187c9fa80 RDI: ffff88c186c98a80 [ 168.693593] RBP: ffffcdcb8200fbc0 R08: 0000000000000000 R09: 0000000000000000 [ 168.694941] R10: 0000000000000000 R11: 0000000000000000 R12: ffff88c186c98a80 [ 168.696289] R13: 00007fff005aaa20 R14: 0000000000000080 R15: ffff88c188f4fce0 [ 168.697637] FS: 0000790e81c58280(0000) GS:ffff88c20a957000(0000) knlGS:0000000000000000 [ 168.699227] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 168.700349] CR2: 0000000000000088 CR3: 000000012fd3e000 CR4: 0000000000350ef0 [ 168.701696] Call Trace: [ 168.702325] <TASK> [ 168.702995] rawdata_get_link_data+0x1c/0x30 [ 168.704145] vfs_readlink+0xd4/0x160 [ 168.705152] do_readlinkat+0x114/0x180 [ 168.706214] __x64_sys_readlink+0x1e/0x30 [ 168.708653] x64_sys_call+0x1d77/0x26b0 [ 168.709525] do_syscall_64+0x81/0x500 [ 168.710348] ? do_statx+0x72/0xb0 [ 168.711109] ? putname+0x3e/0x80 [ 168.711845] ? __x64_sys_statx+0xb7/0x100 [ 168.712711] ? x64_sys_call+0x10fc/0x26b0 [ 168.713577] ? do_syscall_64+0xbf/0x500 [ 168.714412] ? do_user_addr_fault+0x1d2/0x8d0 [ 168.715404] ? irqentry_exit+0xb2/0x740 [ 168.716359] ? exc_page_fault+0x90/0x1b0 [ 168.717307] entry_SYSCALL_64_after_hwframe+0x76/0x7e

Threat Intelligence Overview

EPSS Score
0.0%
Top 93% exploitable
Data Quality
4 sources
Confidence: Medium
EUVD NVD CVE.org EPSS Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact· derived
Medium

Priority Score

28
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +28
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Null Pointer Dereference MEDIUM

A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

Same weakness CWE-476 – NULL Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2020-1967 HIGH POC
7.5
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2021-3449 MEDIUM
5.9
CVE-2015-3194 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-45965 ADVISORY https://ubuntu.com/security/notices/USN-8492-1 ADVISORY https://vuldb.com/vuln/366178 REF https://git.kernel.org/stable/c/1432ab0774cba43e8111be39989ff226531a9bac REF https://git.kernel.org/stable/c/19f2e4055626a58842ddec3282ad4465a80c6625 REF https://git.kernel.org/stable/c/1d2b2b58fde9059a488bc25399e6c3d74e9b5548 REF https://git.kernel.org/stable/c/3c36b87fc2a4cf88eadea8cf13923bd2b4f9a3fa REF https://git.kernel.org/stable/c/6d8c180c825cbc73eeffaa79591f8e142dacae70 REF https://git.kernel.org/stable/c/b25298e89a297c42eb4c4d6f081d60375b820abb REF https://git.kernel.org/stable/c/df9ac55abd18628bd8cff687ea043660532a3654 REF https://git.kernel.org/stable/c/e6b2fc7e34d4e7ca6b8598c33a3d45d59e455d8d

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy