Ubuntu Linux EUVD-2026-32984

Exploitation requires a local shell session with at least low-privilege credentials (PR:L per CVSS vector) on an Ubuntu Linux system running kernel version 6.8, 6.17, or 7.0 with Canonical SAUCE patches applied - this is the default condition for Ubuntu-packaged kernels, not a special configuration. The vulnerability is specifically triggered through the AppArmor notification response interface, meaning AppArmor must be active (which is the Ubuntu default). Factors limiting exploitation include: the attack vector is strictly local (AV:L) with no remote or network-based trigger path; scope is unchanged (S:U), confining impact to the vulnerable component; and the maximum achievable impact is limited integrity modification (I:L) with no confidentiality or availability effect. Exploitation is not automatable at scale due to the local access prerequisite.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) places this firmly in Low severity territory. Attack vector is local, requiring physical or authenticated shell access; no network exposure exists. Complexity is low and no user interaction is required, but standard low-privilege credentials are still needed (PR:L), ruling out fully unauthenticated exploitation. Impact is limited exclusively to integrity (I:L) with no confidentiality or availability consequences. No EPSS score was provided in the available data, so exploitation probability cannot be quantified against baseline. The vulnerability is not listed in CISA KEV, and no public proof-of-concept has been identified. The combination of local-only access, low-privilege requirement, minimal impact scope, and absence of any exploit activity makes this a low real-world priority for most organizations. The primary risk surface is multi-tenant environments (shared hosts, container breakout vectors) where untrusted local users exist.

A local user with a standard low-privilege shell account on an affected Ubuntu system constructs a malformed AppArmor notification response containing a name field whose declared size does not correspond to its actual length. By submitting this crafted response, the user triggers the unvalidated code path in the SAUCE kernel patch, causing the kernel to process the invalid size value and potentially allowing limited manipulation of kernel-side data structures. No public exploit code has been identified at time of analysis.