CVE-2026-45884 Details
Description
In the Linux kernel, the following vulnerability has been resolved: apparmor: avoid per-cpu hold underflow in aa_get_buffer When aa_get_buffer() pulls from the per-cpu list it unconditionally decrements cache->hold. If hold reaches 0 while count is still non-zero, the unsigned decrement wraps to UINT_MAX. This keeps hold non-zero for a very long time, so aa_put_buffer() never returns buffers to the global list, which can starve other CPUs and force repeated kmalloc(aa_g_path_max) allocations. Guard the decrement so hold never underflows.
A vulnerability in the Linux kernel's AppArmor module has been addressed, specifically related to the management of per-CPU buffer holds. The issue arose in the function 'aa_get_buffer()', which improperly handled the decrement of a hold counter. When the hold counter reached zero while another count remained active, the unsigned decrement would wrap around, causing an underflow. This underflow kept the hold counter non-zero for an extended period, preventing the 'aa_put_buffer()' function from returning buffers to the global list. As a result, other CPUs could be starved of resources, leading to excessive memory allocations. The vulnerability has been fixed by adding a guard to the decrement operation, ensuring that the hold counter cannot underflow.
Users can upgrade to the latest version of the Linux kernel where this vulnerability has been fixed. Instructions for downloading the patched version are available on the Linux kernel's official website.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/202824a1f89a9786c20a3d646a7c88d223abb1b2 | kernel.org | Patch |
| https://git.kernel.org/stable/c/4bcddd0f6b2e52b4c7b520e4d36a115caf5b7169 | kernel.org | Patch |
| https://git.kernel.org/stable/c/640cf2f09575c9dc344b3f7be2498d31e3923ead | kernel.org | Patch |
| https://git.kernel.org/stable/c/80c334acc6d0bee8605a358a33e69b4aea1ffb92 | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-191 | Integer Underflow (Wrap or Wraparound) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 6.7, < 6.12.75 >= 6.13, < 6.18.14 >= 6.19, < 6.19.4 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 25, 2026 | Initial Analysis | [email protected] |
| Jun 17, 2026 | CVE Modified | kernel.org |
| May 27, 2026 | New CVE Received | kernel.org |