PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-47332 Canonical CVE debrief

A medium-severity local information disclosure vulnerability exists in Ubuntu Linux kernel versions 6.8, 6.17, and 7.0. The issue stems from AppArmor SAUCE patches that fail to properly validate the size of an internal structure during notification handling, resulting in an out-of-bounds read. An unprivileged local attacker can trigger this flaw to leak information from adjacent slab objects. The vulnerability was published on May 28, 2026, and is not currently listed in CISA's Known Exploited Vulnerabilities catalog.

Vendor
Canonical
Product
Ubuntu Linux
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-06-09
Advisory published
2026-05-28
Advisory updated
2026-06-09

Who should care

System administrators managing Ubuntu Linux deployments with kernel versions 6.8, 6.17, or 7.0; security teams responsible for Linux endpoint protection; organizations with multi-user Ubuntu systems where unprivileged local access is permitted.

Technical summary

The vulnerability exists in AppArmor SAUCE (Ubuntu-specific) patches within the Linux kernel notification handling code. An incorrect size validation of an internal structure allows an out-of-bounds read when processing notifications. This memory safety defect can be exploited by unprivileged local users to read adjacent slab object contents, resulting in information disclosure. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) reflects local attack vector with low complexity and high confidentiality impact.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel updates from Ubuntu security repositories when available
  • Monitor Ubuntu Security Notices for patch availability
  • Restrict local user access where possible until patching is complete
  • Review systems running Ubuntu Linux kernel versions 6.8, 6.17, or 7.0 for exposure

Evidence notes

Vulnerability description and CVSS scoring derived from official NVD record. Technical details regarding affected kernel versions and AppArmor SAUCE patches sourced from CVE description. Patch commit reference available via Launchpad Git repository.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-47332 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-47332

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-47332 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-47332

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.