Ubuntu Linux CVE-2026-47327

Exploitation requires local access with a low-privileged user account (confirmed by CVSS PR:L). The system must be running Ubuntu Linux kernel version 6.8, 6.17, or 7.0 with Ubuntu SAUCE patches applied - stock upstream or non-Ubuntu kernels are not affected. AppArmor must be active (which is the default configuration on Ubuntu, not a non-default setting), and the notification handling path within AppArmor must be reachable by the triggering user action. Exploitation is constrained to local authenticated sessions: remote unauthenticated exploitation is not possible per the CVSS AV:L vector. The impact is limited strictly to availability (kernel oops/crash) - no privilege escalation, code execution, or data exposure paths are indicated.

The overall risk is low. The CVSS 3.1 base score of 3.3 reflects a local attack vector (AV:L), low attack complexity (AC:L), low privilege requirement (PR:L), no user interaction (UI:N), unchanged scope (S:U), and availability-only impact (C:N/I:N/A:L). This means any unprivileged local user account can trigger the crash, but the attacker must already have shell access to the machine. No EPSS data was provided, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. No proof-of-concept exploit code has been identified. The practical threat is limited to local denial-of-service - crashing a kernel causes disruption but offers no privilege escalation or data exposure path based on available data. Multi-tenant systems (shared Linux hosts, container hosts without strong isolation) face slightly elevated risk since any tenant account could crash the shared kernel.

A local user with a standard unprivileged account on an affected Ubuntu system invokes an operation that triggers the AppArmor notification code path - such as attempting an action that AppArmor is configured to audit or notify on - causing the kernel to dereference a NULL pointer in the SAUCE-patched notification handler. The result is a kernel oops, which crashes or restarts the system, constituting a local denial-of-service. No public proof-of-concept code has been identified at time of analysis.