CVE-2026-47335: Ubuntu Linux 6.8 AppArmor NULL Pointer Dereference Denial of Service

Technical summary

CVE-2026-47335 involves a NULL pointer dereference (CWE-476) in the AppArmor notification handling code within Ubuntu Linux 6.8's SAUCE patch set. The vulnerability is triggered when the kernel receives a malformed or missing pointer during AppArmor event processing, resulting in a kernel panic. The attack vector is local; an unprivileged user with shell access can invoke the vulnerable code path without requiring additional privileges or user interaction. The defect was introduced as part of the SAUCE (Ubuntu's hardware enablement and patch aggregation layer) updates for kernel 6.8.

Business impact

Organizations running Ubuntu Linux 6.8 face availability risk. An attacker with local user access—such as a compromised application account, insider, or lateral movement from another vulnerability—can crash the system on demand, preventing legitimate workloads from running. In multi-tenant or containerized environments, this could disrupt service to multiple customers or applications. However, since exploitation requires local access and does not grant privilege escalation or data compromise, the threat is primarily one of disruption rather than data breach.

Affected systems

Ubuntu Linux kernel 6.8 is affected. This kernel is typically deployed on Ubuntu 24.04 LTS and related Ubuntu releases during the 6.8 kernel cycle. Systems running earlier kernel versions (6.7 or older) or later versions (6.9 and beyond, if updated) are not affected by this specific vulnerability. Verify your kernel version with `uname -r` to confirm exposure.

Exploitability

Exploitability is straightforward for attackers already possessing local user access. No special tools, privileges, or complex tricks are required; the NULL pointer dereference is triggered by normal AppArmor notification handling, meaning even routine security operations could hit the vulnerability. However, exploitation requires local shell access, which limits the attack surface to insider threats, compromised application accounts, or systems already breached via other means. The vulnerability is not remotely exploitable.

Remediation

Apply a kernel update that patches the AppArmor NULL pointer dereference. Ubuntu typically releases fixes through linux-image package updates. Users should verify the specific patched kernel version in the Ubuntu security advisories and install the updated package via apt. Following patching, reboot the system to load the corrected kernel. Until patching is possible, restrict local user access and monitor for unexpected kernel panic events.

Patch guidance

Check the Ubuntu Security Notices (USN) for Linux 6.8 advisories published on or after 2026-06-17 (the latest modification date for this CVE). The advisory will specify the patched kernel version. Typical Ubuntu practice involves releasing a new linux-image package; install it with `sudo apt update && sudo apt install linux-image-generic` (or the equivalent for your Ubuntu flavor), then reboot. Verify the new kernel is active with `uname -r` and confirm it matches the patched version listed in the advisory.

Detection guidance

Monitor system logs for kernel panic messages and console output referencing AppArmor or NULL pointer dereferences. On systems with kdump or similar crash capture enabled, retrieve and analyze crash dumps for NULL pointer dereference signatures in apparmor-related kernel functions. Intrusion detection systems can flag multiple rapid kernel reboots from the same source as a potential indicator of local denial-of-service attempts. However, kernel panics can have many causes; correlate with access logs to identify whether a specific local user account precedes each crash.

Why prioritize this

This vulnerability merits prompt but not emergency patching. The CVSS score of 5.5 (Medium severity) reflects the local-only attack vector and lack of confidentiality or integrity impact. However, availability disruption can significantly harm business operations. Organizations should prioritize patching systems in production environments where local user access is common (shared hosting, multi-tenant systems, development clusters) over isolated systems with minimal local user population. Coordinate patching with maintenance windows to avoid unscheduled downtime.

Risk score, explained

CVSS 3.1 score of 5.5 is driven by: (1) Local attack vector (AV:L)—requiring prior system access; (2) Low attack complexity (AC:L)—straightforward to trigger; (3) Low privileges required (PR:L)—unprivileged user suffices; (4) No user interaction (UI:N); (5) No confidentiality or integrity impact (C:N, I:N); but (6) High availability impact (A:H)—kernel panic causes complete service disruption. The score reflects a real but bounded threat: it hurts availability but not data security.

Frequently asked questions