apparmor: avoid per-cpu hold underflow in aa_get_buffer (CVE-2026-45884) | HOL Guard CVE