What is the CVSS score of EUVD-2026-32991?

EUVD-2026-32991 has a CVSS 3.1 base score of 3.3 (Low). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for EUVD-2026-32991?

Yes, a patch is available for EUVD-2026-32991. Update the affected software to the latest version immediately.

Ubuntu Linux EUVD-2026-32991

| CVE-2026-47336 LOW

Use of Uninitialized Variable (CWE-457)

2026-05-28 canonical

GHSA-cmg4-qjv8-qjh6

Ubuntu Information Disclosure

3.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

3.3 LOW

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 28, 2026 - 19:20 vuln.today

DescriptionCVE.org

Ubuntu Linux 6.8 contains SAUCE patches with a possible use of an uninitialized variable in AppArmor AF_INET/AF_INET6 socket mediation code. The bug can be triggered by an unprivileged local user and could result in incorrect fine-grained mediation of network sockets.

AnalysisAI

Uninitialized variable use in Ubuntu Linux 6.8's AppArmor AF_INET/AF_INET6 socket mediation code allows an authenticated local user to cause incorrect enforcement of fine-grained network socket access controls. The flaw resides in Ubuntu-specific SAUCE patches layered on top of the mainline Linux 6.8 kernel, meaning it is not present in upstream distributions. No public exploit code or active exploitation has been identified at time of analysis; Canonical has issued a fix via the Ubuntu Noble kernel repository.

Technical ContextAI

The vulnerability (CWE-457: Use of Uninitialized Variable) resides in Ubuntu's SAUCE patches - Ubuntu-proprietary kernel modifications applied on top of mainline Linux 6.8 in the Noble (Ubuntu 24.04 LTS) release. Specifically, the flaw is in the AppArmor Linux Security Module's mediation path for AF_INET and AF_INET6 socket operations. When the kernel evaluates AppArmor policy for network socket creation or access, an uninitialized variable in the mediation path may yield an indeterminate value, causing policy decisions to be made on corrupt or arbitrary state. CPE data (cpe:2.3:a:canonical:ubuntu_linux:*:*:*:*:*:*:*:*) confirms Canonical's Ubuntu Linux as the affected product family, with the Noble kernel tree (kernel 6.8) specifically implicated by the Launchpad commit reference.

RemediationAI

Patch available per vendor advisory from Canonical. Apply the fix committed to the Ubuntu Noble kernel tree (commit f37c6a70fe7b435322c334554002809a4e7b7293) available at https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/noble/commit/?id=f37c6a70fe7b435322c334554002809a4e7b7293. Ubuntu 24.04 LTS users should apply the updated kernel package via standard package management (apt-get update && apt-get upgrade linux-image-generic) once Canonical publishes the patched kernel to the Noble security pocket. An exact fixed package version was not confirmed in the available data - monitor Ubuntu Security Notices (USN) for the corresponding advisory. As a compensating control prior to patching, administrators with strict AppArmor socket mediation requirements can audit active AppArmor profiles to detect and temporarily relax socket-rule-heavy profiles for sensitive processes, reducing reliance on the affected mediation path; note this trades security policy enforcement for stability during the patch window.