CVE-2026-47328: Ubuntu Linux Kernel Memory Corruption via AppArmor SAUCE Patches

Technical summary

CVE-2026-47328 is a double-free and memory leak vulnerability in AppArmor SAUCE patches applied to Ubuntu Linux kernels 6.8, 6.17, and 7.0. The defect involves improper kernel memory management (kmalloc/kfree) within AppArmor enforcement code. An unprivileged local attacker can trigger the flawed code path, causing slab metadata corruption and potential kernel panic or resource exhaustion. The vulnerability is classified as CWE-590 (Free of Memory not on the Heap).

Business impact

Organizations running affected Ubuntu kernel versions face availability risk. Unprivileged users—including compromised application processes or containers—can trigger kernel instability, leading to system crashes, denial of service, or degraded performance during peak operations. In multi-tenant environments or cloud deployments, this becomes a lateral privilege escalation vector, allowing one tenant to disrupt service for others. Recovery requires kernel patching and system reboot, incurring downtime and operational overhead.

Affected systems

Ubuntu Linux kernel versions 6.8, 6.17, and 7.0 are affected. Any system running these specific kernel versions is vulnerable. This includes Ubuntu LTS and standard releases that shipped with or were updated to these kernel versions. Check your kernel version with 'uname -r' to confirm exposure. Non-affected versions and distributions without these SAUCE patches are not vulnerable.

Exploitability

Exploitability is straightforward: the vulnerability requires only local access and unprivileged user privileges. No special configuration, authentication bypass, or user interaction is needed. Any local process can potentially trigger the memory corruption. However, reliable weaponization into a practical exploit requires intimate knowledge of kernel memory layout and slab allocator internals. The barrier to triggering a denial-of-service is low; escalating to arbitrary code execution is substantially higher but not ruled out with sophisticated heap grooming.

Remediation

Apply kernel security updates provided by Canonical for Ubuntu Linux 6.8, 6.17, and 7.0. Verify the patched kernel version against the official Ubuntu security advisories. After patching, reboot the system to activate the new kernel. Temporarily, restrict local user access and monitor for unexpected kernel crashes or resource exhaustion as indicators of exploitation attempts.

Patch guidance

Consult Canonical's Ubuntu security advisories and the Ubuntu kernel team repositories for specific patched kernel versions addressing CVE-2026-47328 for each affected kernel series (6.8.x, 6.17.x, 7.0.x). Use 'apt update && apt upgrade' or your standard patch management process to pull and install patched kernels. Test patched kernels in non-production environments first to confirm stability. Mandatory reboot is required to activate the patched kernel.

Detection guidance

Monitor system logs (dmesg, kernel logs) for slab corruption warnings, double-free errors, or unexpected kernel oops messages. Kernel Address Sanitizer (KASAN) or similar debugging facilities can aid in detecting slab metadata corruption if enabled. In production, alerting on unexpected kernel crashes or high memory churn from a single process can indicate exploitation. Behavioral anomalies such as frequent out-of-memory conditions on a system with available resources warrant investigation.

Why prioritize this

Although this vulnerability has a MEDIUM CVSS score (6.1) and is not on the CISA KEV list, it deserves prompt attention because: (1) exploitation requires only local access and no privileges, making it a realistic threat in multi-tenant environments; (2) slab corruption can cascade into further kernel instability; (3) system availability impact is direct and measurable; (4) patching is straightforward and carries low risk. Prioritize systems hosting untrusted workloads or multi-tenant services.

Risk score, explained

The CVSS 3.1 score of 6.1 reflects a local attack vector (AV:L), low attack complexity (AC:L), low privileges required (PR:L), no user interaction (UI:N), and no confidentiality impact (C:N). The integrity and availability impacts are high (I:L/A:H), acknowledging that slab corruption can corrupt kernel data structures and lead to denial of service. The score appropriately reflects the severity relative to remote or privileged-only vulnerabilities, but underscores the significant availability risk in local threat scenarios.

Frequently asked questions