CVE-2026-47330: AppArmor Cache Poisoning in Ubuntu Linux 6.8, 7.0, 7.17

Technical summary

The vulnerability exists in AppArmor notification handling within Ubuntu's SAUCE patch series for kernels 6.8, 7.17, and 7.0. The root cause is use of an uninitialized variable (CWE-457) in the notification response caching mechanism. An unprivileged local attacker can trigger this code path without elevated privileges or user interaction, causing AppArmor to store incorrect policy response data in its notification cache. This breaks the assumption that cached AppArmor decisions are trustworthy, potentially affecting enforcement of mandatory access controls for subsequent operations.

Business impact

Organizations relying on AppArmor as a core security boundary for containerized workloads or multi-tenant systems face reduced policy enforcement reliability. Poisoned AppArmor caches could permit unauthorized resource access or policy bypass for applications that depend on consistent AppArmor decision enforcement. While direct privilege escalation is not demonstrated, the cache corruption enables policy evasion. Affected Ubuntu deployments require prompt patching to restore AppArmor's integrity guarantees, particularly in security-sensitive environments.

Affected systems

Ubuntu Linux 6.8, 7.17, and 7.0 are confirmed vulnerable when deployed with AppArmor SAUCE patches enabled. Check your kernel version and confirm AppArmor is active (systemctl status apparmor). Systems without AppArmor loaded or using stock kernels without SAUCE patches are not affected. Enterprise Ubuntu LTS deployments and containerized Ubuntu hosts are most commonly affected.

Exploitability

Exploitability is straightforward for local attackers. No special privileges are required—an unprivileged user account can trigger the uninitialized variable condition. No user interaction is necessary. The barrier to exploitation is low, making this a practical concern for multi-user systems or containers where untrusted code may run. Remote exploitation is not possible; this is strictly a local attack vector.

Remediation

Patch affected Ubuntu systems immediately. Canonical has released kernel updates addressing the uninitialized variable in AppArmor notification handling. Consult Ubuntu security advisories and your system's package manager for the specific patched kernel version applicable to your release (6.8-X, 7.0-X, or 7.17-X). After patching, reboot to load the corrected kernel. Verify AppArmor functionality post-reboot with aa-status or systemctl status apparmor.

Patch guidance

Check Ubuntu's security advisories for the kernel versions corresponding to your affected release (6.8, 7.0, or 7.17). Use apt update && apt upgrade to fetch patched kernel packages. Verify the new kernel version before rebooting (uname -r). Schedule a maintenance window for reboot if running production workloads, as kernel patches require a restart. After reboot, confirm AppArmor is running and no policy violations are logged (check /var/log/audit/audit.log if auditd is active).

Detection guidance

Monitor for AppArmor policy violations and permission denied errors that may indicate cache poisoning attempts. Log all AppArmor denials (enable auditd if not already active) and correlate with local process activity from unprivileged users. Check kernel dmesg for uninitialized variable warnings or AppArmor cache anomalies. If available, use AppArmor debugging tools (aa-logprof) to inspect rejected operations. In container environments, monitor for unusual policy enforcement inconsistencies across pod restarts.

Why prioritize this

Despite the low CVSS score, this vulnerability merits rapid remediation because it directly corrupts a mandatory access control mechanism. AppArmor cache poisoning could enable silent policy bypass in security-sensitive deployments. Organizations using AppArmor to isolate untrusted workloads or enforce least-privilege containerization should treat this as medium-priority. The ease of exploitation (unprivileged local attack, no interaction) increases practical risk in multi-tenant or lab environments. However, it does not affect systems where AppArmor is disabled.

Risk score, explained

CVSS 3.1 yields a score of 3.3 (LOW) due to limited attack surface: local-only vector (AV:L), low complexity (AC:L), requires low privilege (PR:L), no user interaction (UI:N), and impacts only integrity (I:L) without confidentiality or availability loss. The low score reflects that this is not a remote, high-impact flaw. However, the integrity impact on a security-critical subsystem (AppArmor) and the ease of exploitation argue for faster patching than the score alone suggests. Risk assessment should consider your reliance on AppArmor for workload isolation.

Frequently asked questions