EUVD-2026-32992
GHSA-92c3-4wxg-8jwx
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionCVE.org
Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches with a possible NULL pointer dereference in the handling of AF_INET/AF_INET6 socket mediation. The bug can be triggered by an unprivileged local user. This can lead to a kernel oops.
AnalysisAI
NULL pointer dereference in Ubuntu Linux kernel SAUCE patches (versions 6.8, 6.17, and 7.0) allows an unprivileged local user to trigger a kernel oops, resulting in a denial of service. The flaw resides specifically in Ubuntu's out-of-tree SAUCE patches for AF_INET/AF_INET6 socket mediation - mainline Linux kernel builds are unaffected. No active exploitation is confirmed (not in CISA KEV), no public exploit has been identified at time of analysis, and the CVSS score of 3.3 (Low) accurately reflects the constrained impact: local access only, no confidentiality or integrity loss, and limited availability degradation.
Technical ContextAI
Ubuntu kernels ship with 'SAUCE' (Sauce Applied Ubuntu Canonical Engineering) patches - Canonical-maintained modifications layered on top of the upstream Linux kernel that are not merged into mainline. The affected code path involves socket mediation for AF_INET (IPv4) and AF_INET6 (IPv6) socket families, which are the standard kernel interfaces for TCP/UDP network communication. Socket mediation in this context refers to security-layer interception of socket operations, likely tied to Ubuntu's AppArmor LSM (Linux Security Module) integration within the SAUCE layer. CWE-476 (NULL Pointer Dereference) identifies the root cause: a code path dereferences a pointer without first validating it for NULL, causing a kernel oops - an unrecoverable kernel exception that terminates or destabilizes the running kernel. The CPE string cpe:2.3:a:canonical:ubuntu_linux:*:*:*:*:*:*:*:* confirms the affected product as Canonical's Ubuntu Linux distribution specifically, not upstream Linux.
RemediationAI
Apply the upstream fix committed to the Ubuntu kernel noble branch, available at https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/noble/commit/?id=9f03f0012a2367efae1edb4798f1c5103aeb6cbc - note this is an upstream fix available (commit); a released patched package version is not independently confirmed from available data, so monitor Ubuntu Security Notices (USN) at ubuntu.com/security/notices for official kernel package updates and apply them when published. As a compensating control prior to patch availability, restrict local shell access on affected Ubuntu systems running kernel 6.8, 6.17, or 7.0 - particularly on multi-tenant hosts - to reduce the set of users who can reach the vulnerable socket mediation code path; this has the trade-off of limiting legitimate user access. Disabling AF_INET or AF_INET6 socket families is not a viable workaround as it breaks standard IPv4/IPv6 networking. No network-layer mitigations apply given the local-only attack vector.
More in Ubuntu Linux
View allOracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTT
Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe
Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and
Local privilege escalation in the GNU C Library (glibc) dynamic loader ld.so allows unprivileged local users on affected
Same weakness CWE-476 – NULL Pointer Dereference
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today