PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-47328 Canonical CVE debrief

A memory management vulnerability exists in Ubuntu Linux kernel versions 6.8, 6.17, and 7.0 due to defective AppArmor SAUCE patches. The flaw involves an incorrect attempt to free a pointer that was not allocated via kmalloc(), coupled with a memory leak. An unprivileged local attacker can trigger this bug, leading to slab metadata corruption and potential resource exhaustion. The vulnerability is classified as MEDIUM severity with a CVSS 3.1 score of 6.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H). The weakness is categorized as CWE-590: Free of Memory not on the Heap. The vulnerability was published on May 28, 2026. No known exploitation in the wild or ransomware campaign use has been documented.

Vendor
Canonical
Product
Ubuntu Linux
CVSS
MEDIUM 6.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-06-09
Advisory published
2026-05-28
Advisory updated
2026-06-09

Who should care

System administrators managing Ubuntu Linux deployments, security teams responsible for kernel security posture, and organizations running multi-user Ubuntu systems where unprivileged local access is possible

Technical summary

The vulnerability stems from incorrect memory handling in Ubuntu-specific AppArmor SAUCE (Ubuntu Delta) patches. The code path attempts to kfree() a pointer that was not kmalloc()d, resulting in undefined behavior and slab metadata corruption. Simultaneously, legitimately allocated memory is leaked. The attack vector requires local access with low privileges, no user interaction, and can result in high availability impact through resource exhaustion. The integrity impact is rated low. The vulnerability does not affect confidentiality.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel updates from Ubuntu security repositories when available
  • Monitor Ubuntu Security Notices for patch availability
  • Review systems running affected kernel versions (6.8, 6.17, 7.0)
  • Restrict local user access where possible as interim mitigation
  • Audit for signs of system instability or memory exhaustion that could indicate exploitation attempts

Evidence notes

Vulnerability description and CVSS vector sourced from NVD record. Technical details regarding the AppArmor SAUCE patch defect and kmalloc/free mismatch derived from official CVE description. Commit reference indicates the fix location in Ubuntu kernel source repository.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-47328 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-47328

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-47328 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-47328

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.