EUVD-2026-32981
GHSA-rpqm-wqwm-759w
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches with a memory leak in the handling of big responses to AppArmor notifications. The bug can be triggered by an unprivileged local user. The memory leak could lead to resource exhaustion.
AnalysisAI
Memory exhaustion via AppArmor notification handling affects Ubuntu Linux kernel versions carrying Ubuntu-specific SAUCE patches (6.8, 6.17, 7.0). An unprivileged local user can trigger a memory leak by eliciting large responses to AppArmor userspace notifications, repeatedly consuming kernel memory without release. No active exploitation confirmed (not in CISA KEV) and no public exploit code identified, but the low-privilege local trigger lowers the bar for insider or co-tenant abuse in multi-user and container environments.
Technical ContextAI
The vulnerability resides in Ubuntu's SAUCE patch layer - Ubuntu-specific kernel modifications not present in mainline Linux - specifically in the AppArmor Linux Security Module's notification subsystem. AppArmor userspace notifications allow applications to receive and respond to security policy events; when those responses are large ('big responses'), the kernel code path fails to release allocated memory, constituting a classic CWE-401 (Missing Release of Memory after Effective Lifetime) defect. The affected CPE is cpe:2.3:a:canonical:ubuntu_linux covering kernel versions 6.8, 6.17, and 7.0 as shipped by Canonical. Because SAUCE patches are Ubuntu-proprietary, this bug does not affect upstream or other distribution kernels.
RemediationAI
Apply the upstream fix commit available in the Ubuntu kernel noble branch at https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/noble/commit/?id=8d858ecb7e2e216ca2987302a04c266f2355fefe. This is a source-level commit fix; an exact released kernel package version incorporating this fix has not been independently confirmed from the available data, so monitor Ubuntu Security Notices (USN) for a corresponding kernel package update for Ubuntu 24.04 LTS. As a compensating control prior to patching, administrators can restrict access to AppArmor notification features by limiting which users or processes can interact with AppArmor's notify socket (e.g., via namespace isolation or seccomp profiles), though this may break applications relying on AppArmor userspace notification policies. On systems where AppArmor notify functionality is not required, disabling the notify feature reduces attack surface with no operational impact to standard AppArmor policy enforcement.
More in Ubuntu Linux
View allOracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTT
Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe
Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and
Local privilege escalation in the GNU C Library (glibc) dynamic loader ld.so allows unprivileged local users on affected
Same weakness CWE-401 – Memory Leak
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today