Ubuntu Linux CVE-2026-47328

Exploitation requires a local interactive session with standard unprivileged user privileges (PR:L per CVSS vector) - no elevated permissions, sudo access, or special group membership is needed. The target system must be running Ubuntu Linux kernel version 6.8, 6.17, or 7.0 with the AppArmor SAUCE patches applied, which are present by default on Ubuntu but absent from upstream kernels and all other distributions. AppArmor must be active and loaded, which is its default state on Ubuntu. Remote exploitation is not possible (AV:L); an attacker must have authenticated local shell access, whether physical, SSH-based, or via a prior compromise. Container workloads sharing an affected Ubuntu host kernel are also at risk if container users can trigger the code path. Non-default conditions that would prevent exploitation include: running an upstream kernel without SAUCE patches, operating on a non-Ubuntu distribution, or having AppArmor explicitly disabled.

CVSS 6.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H) accurately reflects a locally exploitable, low-complexity privilege escalation of impact - not of access level. The High availability impact is the dominant risk signal, representing potential kernel crash or progressive resource exhaustion. The local attack vector (AV:L) is the primary mitigating factor: remote attackers cannot directly trigger this without first obtaining a local shell. PR:L means any standard unprivileged user account suffices - no sudo or special group membership is required. No EPSS score was provided in the input data, so exploitation probability cannot be quantified. The absence of a CISA KEV listing and the absence of any identified public POC suggest low current threat activity. The real-world priority is elevated on multi-tenant Ubuntu systems - shared cloud instances, VMs with multiple local users, or environments where untrusted users have shell access - and is lower on single-user workstations. The I:L integrity signal likely reflects indirect slab metadata writes rather than a controlled write primitive.

A standard unprivileged user on a multi-tenant Ubuntu 7.0 server (e.g., a shared development host) opens a shell and invokes system operations that route through the vulnerable AppArmor SAUCE code path - no special tools or root access required given AC:L/PR:L. Each trigger corrupts slab allocator metadata and leaks kernel memory; repeated invocations progressively exhaust kernel resources and ultimately crash the machine or render it unresponsive, denying service to all users. No public proof-of-concept was identified at time of analysis, but the low attack complexity indicates exploitation would be straightforward once the triggering syscall sequence is identified.