EUVD-2026-32987
GHSA-4hmr-4vjc-3rg2
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which incorrectly validate the size of an internal structure, leading to an out-of-bounds read in notification handling code. The bug can be triggered by an unprivileged local user and can result in information disclosure from adjacent slab objects.
AnalysisAI
Out-of-bounds read in Ubuntu Linux kernels 6.8, 6.17, and 7.0 exposes adjacent slab allocator memory to any local low-privileged user. The flaw originates in Canonical's Ubuntu-specific AppArmor SAUCE patches, which incorrectly validate the size of an internal structure during notification handling, enabling controlled reads past the intended memory boundary. No public exploit identified at time of analysis, and exploitation is strictly local; however, C:H in the CVSS vector confirms that successful exploitation can yield high-sensitivity kernel or cross-process data from slab neighbors.
Technical ContextAI
The vulnerable code resides in Ubuntu-specific AppArmor 'SAUCE' patches - downstream kernel modifications maintained by Canonical and not present in upstream Linux. CWE-125 (Out-of-Bounds Read) is the root cause class: a size validation check on an internal AppArmor structure is performed incorrectly, allowing the notification handling code path to read beyond its allocated slab object into adjacent kernel memory. Linux slab allocators (SLUB/SLAB) pack objects contiguously, so an out-of-bounds read can leak data from neighboring objects belonging to any kernel subsystem or user process. The CPE cpe:2.3:a:canonical:ubuntu_linux:*:*:*:*:*:*:*:* confirms this is a Canonical-maintained artifact, not an upstream kernel defect. The tags note 'Buffer Overflow' alongside 'Information Disclosure', but the CVSS vector (I:N/A:N) and CWE-125 classification confirm this is a read-only overread, not a write primitive.
RemediationAI
Apply the vendor-supplied fix available as Launchpad commit 0418e5f61b55465f19245705bce6590c807fc9f2 in the Ubuntu noble kernel git repository (https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/noble/commit/?id=0418e5f61b55465f19245705bce6590c807fc9f2). Patch availability is confirmed per vendor (Canonical), but an exact released package version (e.g., linux-image-X.X.X-XX) is not independently confirmed from available data - monitor Ubuntu Security Notices (USN) for the official patched kernel package corresponding to your Ubuntu release. As a compensating control prior to patching, restrict local shell access to trusted users on affected systems, since exploitation requires local authenticated access (AV:L/PR:L); this does not eliminate the vulnerability but substantially limits the attacker pool. Disabling AppArmor notification functionality may serve as an additional workaround if operationally feasible, though this would degrade AppArmor policy enforcement capability and should be evaluated against the security trade-off.
More in Ubuntu Linux
View allOracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTT
Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe
Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and
Local privilege escalation in the GNU C Library (glibc) dynamic loader ld.so allows unprivileged local users on affected
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today