Ubuntu Linux CVE-2026-47334

Requires a local authenticated session with at minimum a low-privilege standard user account (CVSS PR:L). The vulnerable code path is active only when Ubuntu's AppArmor SAUCE patches are present, which is the default configuration on affected Ubuntu kernel versions 6.8, 6.17, and 7.0 - no special AppArmor profile or non-default configuration is explicitly required beyond AppArmor being loaded. Remote unauthenticated exploitation is not possible (CVSS AV:L). Key limiting factors are: (1) the attacker must have local shell or process execution access on the target system; (2) only Ubuntu-packaged kernels with the SAUCE patchset are affected - systems running mainline upstream kernels are not; (3) the scope is limited to the local system (S:U), meaning a successful attack cannot directly pivot to other hosts.

The CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H scores 5.5 (Medium) and accurately reflects the threat profile: local access is required (AV:L), attack complexity is low (AC:L), only a low-privilege account is needed (PR:L), no user interaction is required (UI:N), and the sole impact is complete availability loss (A:H). No EPSS score was provided in the source data, so exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog and no public exploit or proof-of-concept has been identified at time of analysis. The 'Information Disclosure' tag in the source data conflicts with the CVSS confidentiality impact of C:N - this discrepancy should be verified with Canonical, as the CVSS vector and description do not support any confidentiality impact. Real-world priority is moderate: the low-complexity local trigger on a default-configured Ubuntu system is concerning for shared or multi-tenant environments (VPS hosts, developer workstations with multiple accounts, CI runners), but external attackers cannot trigger this remotely without first gaining local shell access.

A standard unprivileged user on a shared Ubuntu 6.8, 6.17, or 7.0 system crafts a process or uses an existing application that triggers AppArmor's notification handling path - for example, by generating activity that causes AppArmor to dispatch a notification while the vulnerable spinlock code path is active. The kernel incorrectly attempts to sleep while holding the spinlock, inducing a deadlock or kernel panic and causing the entire host to crash or hang, denying service to all other users. No public proof-of-concept has been identified, but the low complexity of the trigger (AC:L, PR:L) suggests the crash can be reproduced without specialized tooling.