EUVD-2026-32990
GHSA-vhq6-qfmv-qf42
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
Ubuntu Linux 6.8 contains SAUCE patches with a possible NULL pointer dereference in the handling of AppArmor notifications. The bug can be triggered by an unprivileged local user. This can lead to a kernel panic.
AnalysisAI
Kernel panic via NULL pointer dereference in Ubuntu Linux 6.8's AppArmor notification handler allows a locally authenticated, unprivileged user to crash the system. The flaw resides in Ubuntu-specific SAUCE patches - out-of-tree modifications maintained by Canonical - meaning the vulnerable code path does not exist in upstream mainline kernels. With a CVSS score of 5.5 and an availability-only impact, the practical consequence is a local denial-of-service: any low-privilege user with shell access can force a kernel panic. No active exploitation has been confirmed by CISA KEV and no public exploit code has been identified at time of analysis.
Technical ContextAI
CWE-476 (NULL Pointer Dereference) describes the root cause: a code path in the AppArmor Linux Security Module's notification subsystem fails to validate a pointer before dereferencing it, triggering a kernel panic when the pointer is NULL. AppArmor is the mandatory access control framework enabled by default on Ubuntu systems. The vulnerable code is exclusive to Canonical's SAUCE (Sauce Applies Ubuntu Changes Everywhere) patch series carried in the Ubuntu 6.8 kernel tree for Noble (Ubuntu 24.04 LTS), as indicated by the 'noble' branch reference in the Launchpad commit URL. Because SAUCE patches are Ubuntu-specific additions not yet merged upstream, distributions tracking mainline Linux 6.8 are unaffected. The CPE string cpe:2.3:a:canonical:ubuntu_linux:*:*:*:*:*:*:*:* covers Canonical's Ubuntu Linux product family broadly; the specific kernel version impacted is the 6.8 series shipping with Ubuntu Noble.
RemediationAI
The primary fix is to apply the patched Ubuntu kernel provided by Canonical. The upstream fix commit is available at https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/noble/commit/?id=406571d530ccdbae6119fe64ce9cf5c74160f20b for the Noble (Ubuntu 24.04 LTS) kernel tree; however, the exact packaged kernel release version incorporating this fix has not been independently confirmed from a tagged release - monitor Ubuntu Security Notices (USN) for the official kernel update announcement. Until the patched kernel package is applied, a targeted compensating control is to disable AppArmor notifications if the feature is not operationally required: this removes the vulnerable code path without disabling AppArmor enforcement itself, though it will suppress notification events used by tools like aa-notify and any applications consuming AppArmor audit events. On systems where untrusted or multi-tenant local user access is not possible, the risk is minimal and patching can follow normal maintenance windows.
More in Ubuntu Linux
View allOracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTT
Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe
Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and
Local privilege escalation in the GNU C Library (glibc) dynamic loader ld.so allows unprivileged local users on affected
Same weakness CWE-476 – NULL Pointer Dereference
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today