Ubuntu Linux CVE-2026-47335

Exploitation requires a local user account with at minimum low-privilege shell access (PR:L per CVSS vector) on a system running Ubuntu Linux 6.8 with Canonical's SAUCE patches - specifically Ubuntu 24.04 LTS Noble. AppArmor must be active, which is the default configuration on Ubuntu systems; no non-default configuration is required beyond having AppArmor operational. No network access, no user interaction from another party, and no elevated privileges are needed. What limits exploitation: (1) local access is mandatory - remote unauthenticated exploitation is not possible per AV:L; (2) the vulnerability is exclusive to Ubuntu's SAUCE-patched 6.8 kernel and does not affect upstream mainline or non-Ubuntu distributions; (3) impact is confined to availability - there is no known path to privilege escalation or data exfiltration from this bug alone.

The CVSS:3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H characterizes this as a low-complexity, local, low-privilege attack with complete availability loss but zero confidentiality or integrity impact. In practical terms, any authenticated shell user - including unprivileged container users or compromised service accounts - can crash the host kernel. No EPSS score was provided in the available data, so exploitation probability cannot be quantified probabilistically. Neither CISA KEV inclusion nor public exploit code has been identified, keeping real-world exploitation risk lower than the availability impact alone might suggest. The attack surface is constrained to systems running the Ubuntu 6.8 kernel with SAUCE patches (Ubuntu 24.04 LTS Noble) and only matters where multi-tenant or hostile local user access is possible - shared servers, developer workstations, or cloud VMs with multiple tenants. On single-user systems, the practical risk is negligible. The CVSS score of 5.5 is appropriate: this is a real denial-of-service risk in multi-user deployments but not a critical priority for isolated single-tenant systems.

An unprivileged user with a local shell account on an Ubuntu 24.04 LTS (Noble) system running a vulnerable 6.8 SAUCE kernel crafts or triggers an AppArmor notification event through normal system interactions, causing the kernel's notification handler to dereference a NULL pointer. This immediately triggers a kernel panic, crashing the entire system and causing a denial of service for all users. No public exploit code has been identified, but the low-complexity trigger conditions suggest a proof-of-concept could be developed with moderate kernel familiarity.