PatchSiren cyber security CVE debrief

CVE-2026-47333 Canonical CVE debrief

CVE-2026-47333 is a heap memory out-of-bounds read vulnerability in Ubuntu Linux kernel AppArmor SAUCE patches affecting versions 6.8, 6.17, and 7.0. The flaw stems from incorrect buffer size computation in notification handling code, which can be triggered by an unprivileged local user and may cause invalid data processing by the AppArmor DFA policy engine. The vulnerability was published on 2026-05-28 with a CVSS 3.1 score of 7.8 (HIGH). The weakness is classified as CWE-125 (Out-of-bounds Read). Affected systems should prioritize kernel updates once patches become available from Ubuntu.

Vendor: Canonical
Product: Ubuntu Linux
CVSS: HIGH 7.8
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-05-28
Original CVE updated: 2026-05-29
Advisory published: 2026-05-28
Advisory updated: 2026-05-29

Who should care

System administrators running Ubuntu Linux with kernel versions 6.8, 6.17, or 7.0; security teams managing AppArmor-protected workloads; organizations relying on Ubuntu LTS releases with mandatory access control policies

Technical summary

The vulnerability exists in Ubuntu-specific SAUCE (Ubuntu Delta) patches for the Linux kernel's AppArmor security module. An incorrect buffer size calculation in notification handling code leads to a heap-based out-of-bounds read. The AppArmor DFA (Deterministic Finite Automaton) policy engine may process invalid data as a result. The attack vector is local, requiring low privileges and no user interaction, with high impact to confidentiality, integrity, and availability per CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Defensive priority

HIGH

Recommended defensive actions

Monitor Ubuntu security notices for kernel updates addressing CVE-2026-47333
Apply kernel patches when available from Ubuntu security repositories
Review AppArmor policy configurations for systems running affected kernel versions
Consider restricting unprivileged user access to AppArmor notification interfaces as temporary mitigation
Audit systems for signs of AppArmor policy engine anomalies or unexpected behavior

Evidence notes

Vulnerability description and CVSS vector sourced from NVD official record. Affected kernel versions and technical details derived from CVE description. Vendor attribution to Ubuntu based on reference domain candidate 'Launchpad' and commit URL pointing to ubuntu-kernel repository.

Official resources

2026-05-28