Ubuntu CVE-2026-6369

Exploitation requires the attacker to have a local unprivileged user account on the system. The Livepatch client must be installed (as the canonical-livepatch snap) and explicitly enabled by an administrator with a valid Ubuntu Pro subscription. The vulnerability is not exploitable on default or unconfigured systems lacking Livepatch activation. No special shell privileges, root access, or elevated permissions are needed to exploit the vulnerability itself - the attacker leverages the unprivileged local account to access the socket. The AT:P (Attack Time Practical) indicator in the CVSS vector suggests some time factor or environmental prerequisite exists, though the specific condition is not detailed in the description; it may relate to Livepatch service state or token generation timing.

CVSS 5.7 with local attack vector (AV:L), low complexity (AC:L), and low privilege requirement (PR:L) indicates moderate real-world risk. The score reflects high confidentiality impact (VC:H) from token theft, with minor integrity and availability impacts (SI:L, SA:L) to Livepatch services. The CVSS vector confirms this is a local attack requiring an unprivileged user account already present on the system, not a network-accessible vulnerability. The temporal aspect (AT:P) suggests some environmental factor limits straightforward exploitation. A critical limiting factor is the exploitation condition: this vulnerability only impacts systems where an administrator has explicitly enabled the Livepatch client and maintains a valid Ubuntu Pro subscription - not default or typical configurations. However, among systems with Livepatch active, the attack is reliable and requires no special privileges or user interaction. The confidentiality impact (token compromise) is the primary concern; the integrity/availability impacts to Livepatch services are secondary. EPSS score and KEV status are unavailable for assessment, limiting exploitation frequency predictions. No public POC is indicated in the provided data. For organizations using Ubuntu Pro with Livepatch enabled, this represents a meaningful privilege-escalation and credential-theft risk requiring patching.

An attacker with a local unprivileged user account on a system running Livepatch sends a specially crafted unauthenticated request to the livepatchd.sock Unix domain socket, retrieving the root-level authentication token. The attacker then uses this token to make authenticated API calls to Livepatch services, accessing updates or services as if they were the legitimate system, potentially causing system disruptions or accessing subscription-restricted features.