CVE-2026-45965
Description
In the Linux kernel, the following vulnerability has been resolved:
apparmor: fix invalid deref of rawdata when export_binary is unset
If the export_binary parameter is disabled on runtime, profiles that were loaded before that will still have their rawdata stored in apparmorfs, with a symbolic link to the rawdata on the policy directory. When one of those profiles are replaced, the rawdata is set to NULL, but when trying to resolve the symbolic links to rawdata for that profile, it will try to dereference profile->rawdata->name when profile->rawdata is now NULL causing an oops. Fix it by checking if rawdata is set.
[ 168.653080] BUG: kernel NULL pointer dereference, address: 0000000000000088 [ 168.657420] #PF: supervisor read access in kernel mode [ 168.660619] #PF: error_code(0x0000) - not-present page [ 168.663613] PGD 0 P4D 0 [ 168.665450] Oops: Oops: 0000 [#1] SMP NOPTI [ 168.667836] CPU: 1 UID: 0 PID: 1729 Comm: ls Not tainted 6.19.0-rc7+ #3 PREEMPT(voluntary) [ 168.672308] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 168.679327] RIP: 0010:rawdata_get_link_base.isra.0+0x23/0x330 [ 168.682768] Code: 90 90 90 90 90 90 90 0f 1f 44 00 00 55 48 89 e5 41 57 41 56 41 55 41 54 53 48 83 ec 18 48 89 55 d0 48 85 ff 0f 84 e3 01 00 00 <48> 83 3c 25 88 00 00 00 00 0f 84 d4 01 00 00 49 89 f6 49 89 cc e8 [ 168.689818] RSP: 0018:ffffcdcb8200fb80 EFLAGS: 00010282 [ 168.690871] RAX: ffffffffaee74ec0 RBX: 0000000000000000 RCX: ffffffffb0120158 [ 168.692251] RDX: ffffcdcb8200fbe0 RSI: ffff88c187c9fa80 RDI: ffff88c186c98a80 [ 168.693593] RBP: ffffcdcb8200fbc0 R08: 0000000000000000 R09: 0000000000000000 [ 168.694941] R10: 0000000000000000 R11: 0000000000000000 R12: ffff88c186c98a80 [ 168.696289] R13: 00007fff005aaa20 R14: 0000000000000080 R15: ffff88c188f4fce0 [ 168.697637] FS: 0000790e81c58280(0000) GS:ffff88c20a957000(0000) knlGS:0000000000000000 [ 168.699227] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 168.700349] CR2: 0000000000000088 CR3: 000000012fd3e000 CR4: 0000000000350ef0 [ 168.701696] Call Trace: [ 168.702325] [ 168.702995] rawdata_get_link_data+0x1c/0x30 [ 168.704145] vfs_readlink+0xd4/0x160 [ 168.705152] do_readlinkat+0x114/0x180 [ 168.706214] __x64_sys_readlink+0x1e/0x30 [ 168.708653] x64_sys_call+0x1d77/0x26b0 [ 168.709525] do_syscall_64+0x81/0x500 [ 168.710348] ? do_statx+0x72/0xb0 [ 168.711109] ? putname+0x3e/0x80 [ 168.711845] ? __x64_sys_statx+0xb7/0x100 [ 168.712711] ? x64_sys_call+0x10fc/0x26b0 [ 168.713577] ? do_syscall_64+0xbf/0x500 [ 168.714412] ? do_user_addr_fault+0x1d2/0x8d0 [ 168.715404] ? irqentry_exit+0xb2/0x740 [ 168.716359] ? exc_page_fault+0x90/0x1b0 [ 168.717307] entry_SYSCALL_64_after_hwframe+0x76/0x7e
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
In the Linux kernel, an AppArmor NULL pointer dereference in rawdata_get_link_base occurs when export_binary is disabled and a profile is replaced, leading to a kernel oops.
Vulnerability
The vulnerability resides in the AppArmor LSM's rawdata_get_link_base function in the Linux kernel. When the /sys/kernel/security/apparmor/ export_binary parameter is disabled at runtime, profiles loaded before the disablement retain their rawdata in apparmorfs with a symbolic link. If a profile that still has a rawdata symlink is replaced, the rawdata pointer is set to NULL, but subsequent resolution of the symbolic link attempts to dereference profile->rawdata->name, causing a NULL pointer dereference and kernel oops. Affected versions include Linux kernel 6.19-rc7 and likely earlier kernels that have AppArmor support.
Exploitation
An attacker needs to have privileges to replace an AppArmor profile (e.g., root or CAP_MAC_ADMIN) and the system must have the export_binary parameter disabled. The attacker would trigger a profile replacement (e.g., via apparmor_parser -r) on a profile that was loaded before export_binary was disabled. When any user or process (e.g., ls) accesses the symbolic link in the policy directory, the kernel crashes.
Impact
The attacker can cause a denial of service via a kernel NULL pointer dereference and crash (oops). This results in system instability or downtime. There is no information disclosure or privilege escalation; the impact is limited to availability.
Mitigation
The fix is implemented in commit b25298e89a2 in the Linux kernel stable tree [1]. It adds a NULL check on profile->rawdata before dereferencing. Users should apply the patch or update to a kernel version that includes the fix. A workaround is to avoid disabling export_binary if profiles need to be replaced, or to reload all profiles after disabling export_binary. The CVE is not listed in CISA KEV as of publication.
AI Insight generated on May 27, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
1Patches
16b25298e89a29apparmor: fix invalid deref of rawdata when export_binary is unset
1 file changed · +9 −1
security/apparmor/apparmorfs.c+9 −1 modifieddiff --git a/security/apparmor/apparmorfs.c b/security/apparmor/apparmorfs.c index c2a09056c70141..6885ecd4afddca 100644 --- a/security/apparmor/apparmorfs.c +++ b/security/apparmor/apparmorfs.c @@ -1637,6 +1637,15 @@ static const char *rawdata_get_link_base(struct dentry *dentry, label = aa_get_label_rcu(&proxy->label); profile = labels_profile(label); + + /* rawdata can be null when aa_g_export_binary is unset during + * runtime and a profile is replaced + */ + if (!profile->rawdata) { + aa_put_label(label); + return ERR_PTR(-ENOENT); + } + depth = profile_depth(profile); target = gen_symlink_name(depth, profile->rawdata->name, name); aa_put_label(label); -- cgit 1.3-korg
19f2e4055626apparmor: fix invalid deref of rawdata when export_binary is unset
1 file changed · +9 −1
security/apparmor/apparmorfs.c+9 −1 modifieddiff --git a/security/apparmor/apparmorfs.c b/security/apparmor/apparmorfs.c index 01b923d97a4461..584b40718ecb70 100644 --- a/security/apparmor/apparmorfs.c +++ b/security/apparmor/apparmorfs.c @@ -1631,6 +1631,15 @@ static const char *rawdata_get_link_base(struct dentry *dentry, label = aa_get_label_rcu(&proxy->label); profile = labels_profile(label); + + /* rawdata can be null when aa_g_export_binary is unset during + * runtime and a profile is replaced + */ + if (!profile->rawdata) { + aa_put_label(label); + return ERR_PTR(-ENOENT); + } + depth = profile_depth(profile); target = gen_symlink_name(depth, profile->rawdata->name, name); aa_put_label(label); -- cgit 1.3-korg
1d2b2b58fde9apparmor: fix invalid deref of rawdata when export_binary is unset
1 file changed · +9 −1
security/apparmor/apparmorfs.c+9 −1 modifieddiff --git a/security/apparmor/apparmorfs.c b/security/apparmor/apparmorfs.c index 391a586d0557f0..7803b973b4c427 100644 --- a/security/apparmor/apparmorfs.c +++ b/security/apparmor/apparmorfs.c @@ -1639,6 +1639,15 @@ static const char *rawdata_get_link_base(struct dentry *dentry, label = aa_get_label_rcu(&proxy->label); profile = labels_profile(label); + + /* rawdata can be null when aa_g_export_binary is unset during + * runtime and a profile is replaced + */ + if (!profile->rawdata) { + aa_put_label(label); + return ERR_PTR(-ENOENT); + } + depth = profile_depth(profile); target = gen_symlink_name(depth, profile->rawdata->name, name); aa_put_label(label); -- cgit 1.3-korg
df9ac55abd18apparmor: fix invalid deref of rawdata when export_binary is unset
1 file changed · +9 −1
security/apparmor/apparmorfs.c+9 −1 modifieddiff --git a/security/apparmor/apparmorfs.c b/security/apparmor/apparmorfs.c index 9b4f833e36cd09..5a848c1be05693 100644 --- a/security/apparmor/apparmorfs.c +++ b/security/apparmor/apparmorfs.c @@ -1648,6 +1648,15 @@ static const char *rawdata_get_link_base(struct dentry *dentry, label = aa_get_label_rcu(&proxy->label); profile = labels_profile(label); + + /* rawdata can be null when aa_g_export_binary is unset during + * runtime and a profile is replaced + */ + if (!profile->rawdata) { + aa_put_label(label); + return ERR_PTR(-ENOENT); + } + depth = profile_depth(profile); target = gen_symlink_name(depth, profile->rawdata->name, name); aa_put_label(label); -- cgit 1.3-korg
e6b2fc7e34d4apparmor: fix invalid deref of rawdata when export_binary is unset
1 file changed · +9 −1
security/apparmor/apparmorfs.c+9 −1 modifieddiff --git a/security/apparmor/apparmorfs.c b/security/apparmor/apparmorfs.c index 06eac22665656b..e736936f4f0bad 100644 --- a/security/apparmor/apparmorfs.c +++ b/security/apparmor/apparmorfs.c @@ -1618,6 +1618,15 @@ static const char *rawdata_get_link_base(struct dentry *dentry, label = aa_get_label_rcu(&proxy->label); profile = labels_profile(label); + + /* rawdata can be null when aa_g_export_binary is unset during + * runtime and a profile is replaced + */ + if (!profile->rawdata) { + aa_put_label(label); + return ERR_PTR(-ENOENT); + } + depth = profile_depth(profile); target = gen_symlink_name(depth, profile->rawdata->name, name); aa_put_label(label); -- cgit 1.3-korg
6d8c180c825capparmor: fix invalid deref of rawdata when export_binary is unset
1 file changed · +9 −1
security/apparmor/apparmorfs.c+9 −1 modifieddiff --git a/security/apparmor/apparmorfs.c b/security/apparmor/apparmorfs.c index c70b86f17124ac..bd822f13e32530 100644 --- a/security/apparmor/apparmorfs.c +++ b/security/apparmor/apparmorfs.c @@ -1618,6 +1618,15 @@ static const char *rawdata_get_link_base(struct dentry *dentry, label = aa_get_label_rcu(&proxy->label); profile = labels_profile(label); + + /* rawdata can be null when aa_g_export_binary is unset during + * runtime and a profile is replaced + */ + if (!profile->rawdata) { + aa_put_label(label); + return ERR_PTR(-ENOENT); + } + depth = profile_depth(profile); target = gen_symlink_name(depth, profile->rawdata->name, name); aa_put_label(label); -- cgit 1.3-korg
3c36b87fc2a4apparmor: fix invalid deref of rawdata when export_binary is unset
1 file changed · +9 −1
security/apparmor/apparmorfs.c+9 −1 modifieddiff --git a/security/apparmor/apparmorfs.c b/security/apparmor/apparmorfs.c index ce7b2f43c3193c..fa518cd82366a4 100644 --- a/security/apparmor/apparmorfs.c +++ b/security/apparmor/apparmorfs.c @@ -1626,6 +1626,15 @@ static const char *rawdata_get_link_base(struct dentry *dentry, label = aa_get_label_rcu(&proxy->label); profile = labels_profile(label); + + /* rawdata can be null when aa_g_export_binary is unset during + * runtime and a profile is replaced + */ + if (!profile->rawdata) { + aa_put_label(label); + return ERR_PTR(-ENOENT); + } + depth = profile_depth(profile); target = gen_symlink_name(depth, profile->rawdata->name, name); aa_put_label(label); -- cgit 1.3-korg
1432ab0774cbapparmor: fix invalid deref of rawdata when export_binary is unset
1 file changed · +9 −1
security/apparmor/apparmorfs.c+9 −1 modifieddiff --git a/security/apparmor/apparmorfs.c b/security/apparmor/apparmorfs.c index 907bd2667e28c7..9252172d50682b 100644 --- a/security/apparmor/apparmorfs.c +++ b/security/apparmor/apparmorfs.c @@ -1644,6 +1644,15 @@ static const char *rawdata_get_link_base(struct dentry *dentry, label = aa_get_label_rcu(&proxy->label); profile = labels_profile(label); + + /* rawdata can be null when aa_g_export_binary is unset during + * runtime and a profile is replaced + */ + if (!profile->rawdata) { + aa_put_label(label); + return ERR_PTR(-ENOENT); + } + depth = profile_depth(profile); target = gen_symlink_name(depth, profile->rawdata->name, name); aa_put_label(label); -- cgit 1.3-korg
19f2e4055626apparmor: fix invalid deref of rawdata when export_binary is unset
1 file changed · +9 −1
security/apparmor/apparmorfs.c+9 −1 modifieddiff --git a/security/apparmor/apparmorfs.c b/security/apparmor/apparmorfs.c index 01b923d97a4461..584b40718ecb70 100644 --- a/security/apparmor/apparmorfs.c +++ b/security/apparmor/apparmorfs.c @@ -1631,6 +1631,15 @@ static const char *rawdata_get_link_base(struct dentry *dentry, label = aa_get_label_rcu(&proxy->label); profile = labels_profile(label); + + /* rawdata can be null when aa_g_export_binary is unset during + * runtime and a profile is replaced + */ + if (!profile->rawdata) { + aa_put_label(label); + return ERR_PTR(-ENOENT); + } + depth = profile_depth(profile); target = gen_symlink_name(depth, profile->rawdata->name, name); aa_put_label(label); -- cgit 1.3-korg
3c36b87fc2a4apparmor: fix invalid deref of rawdata when export_binary is unset
1 file changed · +9 −1
security/apparmor/apparmorfs.c+9 −1 modifieddiff --git a/security/apparmor/apparmorfs.c b/security/apparmor/apparmorfs.c index ce7b2f43c3193c..fa518cd82366a4 100644 --- a/security/apparmor/apparmorfs.c +++ b/security/apparmor/apparmorfs.c @@ -1626,6 +1626,15 @@ static const char *rawdata_get_link_base(struct dentry *dentry, label = aa_get_label_rcu(&proxy->label); profile = labels_profile(label); + + /* rawdata can be null when aa_g_export_binary is unset during + * runtime and a profile is replaced + */ + if (!profile->rawdata) { + aa_put_label(label); + return ERR_PTR(-ENOENT); + } + depth = profile_depth(profile); target = gen_symlink_name(depth, profile->rawdata->name, name); aa_put_label(label); -- cgit 1.3-korg
1d2b2b58fde9apparmor: fix invalid deref of rawdata when export_binary is unset
1 file changed · +9 −1
security/apparmor/apparmorfs.c+9 −1 modifieddiff --git a/security/apparmor/apparmorfs.c b/security/apparmor/apparmorfs.c index 391a586d0557f0..7803b973b4c427 100644 --- a/security/apparmor/apparmorfs.c +++ b/security/apparmor/apparmorfs.c @@ -1639,6 +1639,15 @@ static const char *rawdata_get_link_base(struct dentry *dentry, label = aa_get_label_rcu(&proxy->label); profile = labels_profile(label); + + /* rawdata can be null when aa_g_export_binary is unset during + * runtime and a profile is replaced + */ + if (!profile->rawdata) { + aa_put_label(label); + return ERR_PTR(-ENOENT); + } + depth = profile_depth(profile); target = gen_symlink_name(depth, profile->rawdata->name, name); aa_put_label(label); -- cgit 1.3-korg
1432ab0774cbapparmor: fix invalid deref of rawdata when export_binary is unset
1 file changed · +9 −1
security/apparmor/apparmorfs.c+9 −1 modifieddiff --git a/security/apparmor/apparmorfs.c b/security/apparmor/apparmorfs.c index 907bd2667e28c7..9252172d50682b 100644 --- a/security/apparmor/apparmorfs.c +++ b/security/apparmor/apparmorfs.c @@ -1644,6 +1644,15 @@ static const char *rawdata_get_link_base(struct dentry *dentry, label = aa_get_label_rcu(&proxy->label); profile = labels_profile(label); + + /* rawdata can be null when aa_g_export_binary is unset during + * runtime and a profile is replaced + */ + if (!profile->rawdata) { + aa_put_label(label); + return ERR_PTR(-ENOENT); + } + depth = profile_depth(profile); target = gen_symlink_name(depth, profile->rawdata->name, name); aa_put_label(label); -- cgit 1.3-korg
df9ac55abd18apparmor: fix invalid deref of rawdata when export_binary is unset
1 file changed · +9 −1
security/apparmor/apparmorfs.c+9 −1 modifieddiff --git a/security/apparmor/apparmorfs.c b/security/apparmor/apparmorfs.c index 9b4f833e36cd09..5a848c1be05693 100644 --- a/security/apparmor/apparmorfs.c +++ b/security/apparmor/apparmorfs.c @@ -1648,6 +1648,15 @@ static const char *rawdata_get_link_base(struct dentry *dentry, label = aa_get_label_rcu(&proxy->label); profile = labels_profile(label); + + /* rawdata can be null when aa_g_export_binary is unset during + * runtime and a profile is replaced + */ + if (!profile->rawdata) { + aa_put_label(label); + return ERR_PTR(-ENOENT); + } + depth = profile_depth(profile); target = gen_symlink_name(depth, profile->rawdata->name, name); aa_put_label(label); -- cgit 1.3-korg
6d8c180c825capparmor: fix invalid deref of rawdata when export_binary is unset
1 file changed · +9 −1
security/apparmor/apparmorfs.c+9 −1 modifieddiff --git a/security/apparmor/apparmorfs.c b/security/apparmor/apparmorfs.c index c70b86f17124ac..bd822f13e32530 100644 --- a/security/apparmor/apparmorfs.c +++ b/security/apparmor/apparmorfs.c @@ -1618,6 +1618,15 @@ static const char *rawdata_get_link_base(struct dentry *dentry, label = aa_get_label_rcu(&proxy->label); profile = labels_profile(label); + + /* rawdata can be null when aa_g_export_binary is unset during + * runtime and a profile is replaced + */ + if (!profile->rawdata) { + aa_put_label(label); + return ERR_PTR(-ENOENT); + } + depth = profile_depth(profile); target = gen_symlink_name(depth, profile->rawdata->name, name); aa_put_label(label); -- cgit 1.3-korg
b25298e89a29apparmor: fix invalid deref of rawdata when export_binary is unset
1 file changed · +9 −1
security/apparmor/apparmorfs.c+9 −1 modifieddiff --git a/security/apparmor/apparmorfs.c b/security/apparmor/apparmorfs.c index c2a09056c70141..6885ecd4afddca 100644 --- a/security/apparmor/apparmorfs.c +++ b/security/apparmor/apparmorfs.c @@ -1637,6 +1637,15 @@ static const char *rawdata_get_link_base(struct dentry *dentry, label = aa_get_label_rcu(&proxy->label); profile = labels_profile(label); + + /* rawdata can be null when aa_g_export_binary is unset during + * runtime and a profile is replaced + */ + if (!profile->rawdata) { + aa_put_label(label); + return ERR_PTR(-ENOENT); + } + depth = profile_depth(profile); target = gen_symlink_name(depth, profile->rawdata->name, name); aa_put_label(label); -- cgit 1.3-korg
e6b2fc7e34d4apparmor: fix invalid deref of rawdata when export_binary is unset
1 file changed · +9 −1
security/apparmor/apparmorfs.c+9 −1 modifieddiff --git a/security/apparmor/apparmorfs.c b/security/apparmor/apparmorfs.c index 06eac22665656b..e736936f4f0bad 100644 --- a/security/apparmor/apparmorfs.c +++ b/security/apparmor/apparmorfs.c @@ -1618,6 +1618,15 @@ static const char *rawdata_get_link_base(struct dentry *dentry, label = aa_get_label_rcu(&proxy->label); profile = labels_profile(label); + + /* rawdata can be null when aa_g_export_binary is unset during + * runtime and a profile is replaced + */ + if (!profile->rawdata) { + aa_put_label(label); + return ERR_PTR(-ENOENT); + } + depth = profile_depth(profile); target = gen_symlink_name(depth, profile->rawdata->name, name); aa_put_label(label); -- cgit 1.3-korg
Vulnerability mechanics
Root cause
"Missing NULL pointer check on profile->rawdata before dereferencing profile->rawdata->name in rawdata_get_link_base."
Attack vector
An attacker with local access (or any user able to list files in apparmorfs) triggers a kernel NULL pointer dereference by reading a symbolic link under the policy directory for a profile that was loaded before the `export_binary` parameter was disabled at runtime and then replaced. When the profile is replaced, its `rawdata` pointer is set to NULL, but the stale symbolic link remains. Resolving that link via `readlink` or `ls` causes `rawdata_get_link_base` to access `profile->rawdata->name` on the NULL pointer, leading to an oops [patch_id=2660919].
Affected code
The vulnerability is in the `rawdata_get_link_base` function in `security/apparmor/apparmorfs.c` [patch_id=2660919]. The function dereferences `profile->rawdata->name` without first checking whether `profile->rawdata` is NULL.
What the fix does
The patch adds a NULL check for `profile->rawdata` at the beginning of `rawdata_get_link_base`, before the dereference. If `rawdata` is NULL, the function releases the label reference and returns `-ENOENT` via `ERR_PTR`, preventing the NULL pointer dereference and instead returning a clean "no such entry" error to user space [patch_id=2660919].
Preconditions
- configThe aa_g_export_binary AppArmor parameter must be disabled at runtime after profiles have been loaded
- inputA profile that was loaded before export_binary was disabled must be replaced, setting its rawdata to NULL
- inputA user must attempt to resolve the stale symbolic link to the rawdata for that profile (e.g., via readlink or ls)
Generated on May 27, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
8- git.kernel.org/stable/c/1432ab0774cba43e8111be39989ff226531a9bacnvd
- git.kernel.org/stable/c/19f2e4055626a58842ddec3282ad4465a80c6625nvd
- git.kernel.org/stable/c/1d2b2b58fde9059a488bc25399e6c3d74e9b5548nvd
- git.kernel.org/stable/c/3c36b87fc2a4cf88eadea8cf13923bd2b4f9a3fanvd
- git.kernel.org/stable/c/6d8c180c825cbc73eeffaa79591f8e142dacae70nvd
- git.kernel.org/stable/c/b25298e89a297c42eb4c4d6f081d60375b820abbnvd
- git.kernel.org/stable/c/df9ac55abd18628bd8cff687ea043660532a3654nvd
- git.kernel.org/stable/c/e6b2fc7e34d4e7ca6b8598c33a3d45d59e455d8dnvd
News mentions
0No linked articles in our index yet.