Ubuntu Linux Kernel CVE-2026-47331

The attacker must already possess an unprivileged local account with the ability to execute code on the target (CVSS AV:L, PR:L) - remote unauthenticated exploitation is not possible. The system must be running the Ubuntu 6.8 kernel with Canonical's AppArmor SAUCE patches loaded and AppArmor enabled (the default on Ubuntu 24.04 'Noble'); systems with AppArmor disabled, non-Ubuntu kernels, or distributions that do not carry the Ubuntu-specific SAUCE patch are not affected. Successful exploitation also requires winning a kernel race condition, which limits reliability and may require many attempts plus heap-grooming primitives; no user interaction (UI:N) is needed beyond the attacker's own actions.

The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H aligns with the description: local attack vector, low complexity, low privileges required, and full confidentiality, integrity, and availability impact - consistent with a kernel UAF leveraged for LPE. No EPSS score and no SSVC values were supplied, so probabilistic exploitation likelihood cannot be quantified from the available data. The CVE is not in CISA KEV and no public PoC was referenced, suggesting it is not currently under broad exploitation; however, race-condition UAFs in kernel LSM code historically attract exploit researchers, and the description itself acknowledges 'theoretically, arbitrary code execution,' so the issue should be treated as a meaningful local-priv-esc risk on multi-tenant or shared Ubuntu 24.04 hosts rather than a remote/internet-facing emergency.

An attacker who has obtained an unprivileged shell on an Ubuntu 24.04 host - for example via a compromised service account, a CI runner, or a low-privilege SSH user - repeatedly triggers the AppArmor code path that mutates the unlocked linked list from two concurrent threads to win the race. After freeing a still-referenced node, the attacker reclaims the freed slab object with attacker-controlled content and pivots the use-after-free into kernel code execution or credential overwrite to obtain root. No public exploit was identified at time of analysis, but the bug class is well-understood and similar Linux LSM UAFs have historically been weaponized into reliable LPE exploits.