PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-47326 Canonical CVE debrief

A memory leak vulnerability exists in Ubuntu Linux kernel SAUCE patches affecting versions 6.8, 6.17, and 7.0. The flaw occurs in the handling of big responses to AppArmor notifications and can be triggered by an unprivileged local user, potentially leading to resource exhaustion through memory exhaustion. The vulnerability is classified as CWE-401 (Missing Release of Memory after Effective Lifetime). The issue was disclosed on 2026-05-28 with a CVSS 3.1 score of 5.5 (MEDIUM severity), with attack vector local, low attack complexity, low privileges required, and high availability impact. A patch commit is available addressing this issue.

Vendor
Canonical
Product
Ubuntu Linux
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-06-09
Advisory published
2026-05-28
Advisory updated
2026-06-09

Who should care

Organizations running Ubuntu with affected kernel versions, particularly cloud providers and hosting services offering shell access to untrusted users, should prioritize this patch. System administrators of shared/multi-user environments face elevated risk from this local denial-of-service vector.

Technical summary

The vulnerability resides in Ubuntu-specific SAUCE (Ubuntu Delta) patches applied to Linux kernel versions 6.8, 6.17, and 7.0. The memory leak occurs when processing large responses to AppArmor security module notifications. An unprivileged local attacker can trigger this condition repeatedly to exhaust system memory, resulting in denial of service. The flaw is in kernel-space memory management code and does not require special capabilities beyond local user access. The fix involves proper memory deallocation in the AppArmor notification response handling path.

Defensive priority

medium

Recommended defensive actions

  • Apply the kernel patch from the Ubuntu security repository when available
  • Monitor Ubuntu Security Notices for updated kernel packages
  • Consider restricting unprivileged user access to AppArmor notification interfaces where feasible
  • Review systems for signs of memory exhaustion that could indicate exploitation attempts
  • Prioritize patching on multi-tenant systems where unprivileged local access is common

Evidence notes

Vulnerability confirmed through official CVE record and NVD entry. Patch commit identified in Ubuntu kernel Git repository on Launchpad. CVSS vector confirms local attack vector with availability impact. No evidence of known exploitation or ransomware campaign use.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-47326 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-47326

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-47326 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-47326

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.