Ubuntu Linux CVE-2026-47336

Exploitation requires an authenticated local session on the target system with at minimum standard (unprivileged) user privileges - confirmed by CVSS PR:L. The vulnerable code path is active only on Ubuntu 24.04 Noble systems running Linux kernel 6.8 with Ubuntu's SAUCE patches applied; mainline or other distribution kernels are unaffected. AppArmor must be enabled and must have socket mediation rules configured for the relevant AF_INET/AF_INET6 operations; systems with no AppArmor socket mediation policy active would not expose the mediation decision path. Remote exploitation is not possible per CVSS AV:L - an attacker must have existing local access. The impact is constrained to incorrect policy enforcement (integrity bypass), not code execution or privilege escalation, further limiting practical exploitation value.

The CVSS 3.1 base score of 3.3 (LOW) accurately reflects the constrained real-world risk profile. The vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N indicates local access is required, exploitation requires only standard user privileges with no complexity barrier, and the impact is limited to low integrity degradation with no confidentiality or availability consequences. The integrity impact (I:L) reflects policy bypass rather than data corruption - AppArmor socket mediation rules could be incorrectly applied, but the exploitable surface is confined to systems with AppArmor socket mediation active and configured. No EPSS data was provided in the intelligence feed, so exploitation probability cannot be quantified probabilistically. The vulnerability is not listed in CISA KEV, and no POC has been identified. The overall risk is low: this is a security control bypass (AppArmor policy evasion) rather than a code execution or data exfiltration primitive, restricted entirely to local, authenticated attackers on Ubuntu 24.04 systems running the 6.8 SAUCE kernel.

A local user with a standard (non-privileged) shell account on an Ubuntu 24.04 Noble system running kernel 6.8 crafts socket operations targeting AF_INET or AF_INET6 endpoints that invoke the uninitialized variable code path in AppArmor's mediation logic. The uninitialized variable yields an indeterminate mediation decision, causing the kernel to incorrectly permit or deny a socket operation that AppArmor policy should have handled differently. No public POC exists at time of analysis, so exploitation would require independent rediscovery of the triggering socket operation sequence.