Ubuntu Linux Kernel CVE-2026-47326

Exploitation requires a local user account with at least low-privilege access (PR:L per CVSS vector) on an Ubuntu Linux system running a kernel version 6.8, 6.17, or 7.0 that includes Ubuntu's SAUCE patches. The AppArmor notification subsystem must be in use - this is the Ubuntu-specific notify feature, not standard AppArmor policy enforcement, so systems without applications that register AppArmor notification listeners may present a reduced attack surface. No network access is required. Exploitation is limited by: local access requirement (cannot be triggered remotely), low-privilege threshold still requiring a valid user account (anonymous or pre-authentication exploitation is not possible), and the impact being limited to availability - no credential theft or code execution is achievable through this path alone. Mainline kernel users and non-Ubuntu distributions are entirely unaffected.

The CVSS 3.1 score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) accurately represents the threat model: local, low-complexity exploitation requiring only low-privilege access, with no confidentiality or integrity impact, but high availability impact through memory exhaustion. No EPSS data was provided, and the vulnerability is not listed in CISA KEV, indicating no confirmed active exploitation. No public proof-of-concept has been identified. The practical risk is highest in shared multi-user systems, VPS environments, or Kubernetes/container deployments where untrusted local users or processes exist, since repeated triggering of the leak could starve the kernel of memory and cause system instability or denial of service. The absence of remote attack vector and requirement for at least low privilege significantly limits the blast radius compared to the high availability impact score might suggest in isolation.

A low-privileged local user or unprivileged container process with access to the AppArmor notification interface repeatedly submits oversized responses to AppArmor policy notification events, each triggering the unfreed memory allocation. Over time, kernel memory is progressively exhausted, eventually causing the host system or affected container namespace to become unresponsive or crash. No public exploit code has been identified at time of analysis, but the low-complexity trigger makes manual reproduction straightforward for any local user.