The paper investigates a decode-and-forward buffer-aided relay selection for an underlay cognitive radio network in the presence of an eavesdropper. The secondary users operating on the same band used by primary user, so the QoS of primary user should be guaranteed. Eavesdropper can intercept the information transmission from the secondary transmitter or relay to the corresponding receiver, which is considered to threaten the security of cognitive radio networks. Finite buffer size is assumed to be available at the relay, so that the relay can store packets. We propose a max-ratio link selection scheme which can optimize the secrecy transmission performance by considering all possible source-to relay and relay to destination links and selecting the relay having the link which maximizes the signal to eavesdropper channel gain ratio. It incorporates the instantaneous strength of the wireless links as well as the status of the finite relay buffers and adapts the relay selection decision on the strongest available link by dynamically switching between relay reception and transmission, so it can take full advantage of the additional flexibility offered by relays with buffers. A closed-form expression for the secrecy outage probability is obtained, both simulation and theoretical results are shown based on the Markov chain to validate the proposed schemes and demonstrate that the proposed schemes can significantly enhance the secure performance compared to the conventional Max-min relay selection schemes.