Ubuntu Linux CVE-2026-47330

The attacker must have an existing local user account on the target system (PR:L per CVSS vector). The target kernel must be an Ubuntu-packaged kernel build at version 6.8, 7.17, or 7.0 that includes Ubuntu's AppArmor SAUCE patches - standard upstream or non-Ubuntu kernels are not affected. AppArmor must be active and handling notifications on the system (the default state on Ubuntu desktop and server installations). Exploitation is strictly local (AV:L); remote unauthenticated exploitation is not possible. The impact is bounded to integrity of the AppArmor notification response cache only - there is no privilege escalation, no data exfiltration, and no service disruption pathway identified.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) consistently maps to a low-priority finding: attack requires local system access with low privileges, scope is unchanged (no container escape or privilege escalation), and impact is limited solely to a minor integrity degradation of AppArmor's notification cache with no confidentiality or availability consequence. No EPSS score was provided in the available data, but the combination of local-only vector, no public exploit, no KEV listing, and low CVSS strongly implies a very low exploitation probability in practice. The real-world risk is further constrained by the requirement for Ubuntu-specific SAUCE patches to be present - systems running non-Ubuntu kernels or custom builds without these patches are not affected. This is not a prioritization candidate for most environments: it cannot be remotely exploited, does not escalate privileges, and does not expose sensitive data. However, organizations with strict AppArmor-based MAC enforcement should still patch promptly, as cache corruption could subtly affect policy notification fidelity.

A local user account on an affected Ubuntu system sends crafted AppArmor notification interactions that trigger the uninitialized variable read in the kernel notification handling path. The garbage or stale value is then cached as a valid notification response, potentially causing AppArmor to act on an incorrect cached decision in subsequent notification lookups. No public proof-of-concept code is known at this time, and the low-complexity, low-privilege conditions make casual discovery likely but limit the meaningful damage an attacker can cause.