Ubuntu Linux CVE-2026-47332

Exploitation requires local system access with at minimum low-privilege credentials - CVSS PR:L and AV:L confirm authenticated local access is mandatory and remote exploitation is not possible. The flaw is conditional on the target system running Ubuntu Linux kernel version 6.8, 6.17, or 7.0 with Canonical's AppArmor SAUCE patches applied; systems running upstream kernels or non-Ubuntu distributions are not affected. AppArmor must be active and the notification handling subsystem must be reachable by the low-privileged user. No user interaction is required (UI:N) and attack complexity is low (AC:L). Exploitation is bounded by: (1) mandatory local authenticated access - no network path exists; (2) Ubuntu-specific kernel required - upstream Linux is not affected; (3) impact is read-only (I:N/A:N) - no write primitive, no denial of service.

CVSS 5.5 with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N accurately reflects a medium-severity, locally-constrained information disclosure. Attack vector is strictly local (AV:L), meaning remote exploitation is not possible - this is a meaningful limiter. However, AC:L and PR:L indicate that any authenticated local user (e.g., a shared-hosting tenant, a compromised service account, or a container breakout scenario) can trigger the flaw without additional conditions. The C:H score is notable: slab neighbor disclosures can expose kernel pointers, cryptographic material, or credentials from other processes, potentially serving as a stepping stone in a multi-stage kernel exploit chain. KEV status is not provided and active exploitation is not confirmed. EPSS data was not supplied. No public exploit code has been identified. Overall, real-world priority is moderate: low for organizations with strict local-access controls, elevated for multi-tenant or shared compute environments running affected Ubuntu kernel versions.

A local user with a standard unprivileged shell on an affected Ubuntu 6.8, 6.17, or 7.0 system repeatedly triggers the AppArmor notification handling code path - for example, by performing actions that generate AppArmor notifications - causing the flawed size validation to allow reads into adjacent slab memory. The leaked slab contents could include kernel pointers useful for defeating KASLR or sensitive data from co-located kernel objects. No public exploit code has been identified at time of analysis, but attack complexity is rated low (AC:L), suggesting the trigger is straightforward once the code path is understood.