PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-47334 Canonical CVE debrief

A vulnerability in Ubuntu Linux kernel AppArmor SAUCE patches allows unprivileged local users to trigger kernel panic or deadlock through incorrect spinlock handling in notification code. The flaw affects Ubuntu kernels 6.8, 6.17, and 7.0, where the notification handling code sleeps while holding a spinlock—a violation of kernel locking semantics that can cause system instability. This is classified as a medium-severity local denial-of-service vulnerability with CVSS 5.5.

Vendor
Canonical
Product
Ubuntu Linux
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-06-09
Advisory published
2026-05-28
Advisory updated
2026-06-09

Who should care

System administrators running Ubuntu with kernels 6.8, 6.17, or 7.0; security teams managing Linux endpoint security; DevOps engineers maintaining Ubuntu-based container hosts; compliance officers tracking kernel-level vulnerability exposure.

Technical summary

The vulnerability exists in Ubuntu-specific SAUCE (Ubuntu-specific patches) for the AppArmor security module. The notification handling code incorrectly invokes sleeping functions while holding a spinlock, violating the fundamental Linux kernel rule that spinlock critical sections must not sleep. This can be triggered by an unprivileged local user through AppArmor notification interfaces, resulting in either immediate kernel panic or deadlock conditions that render the system unresponsive. The affected code paths are specific to Ubuntu's kernel packaging and do not affect upstream Linux kernels directly.

Defensive priority

medium

Recommended defensive actions

  • Review Ubuntu security notices for kernel updates addressing CVE-2026-47334
  • Prioritize patching systems running Ubuntu kernels 6.8, 6.17, or 7.0
  • Monitor for kernel panic or deadlock indicators in AppArmor-enabled systems
  • Apply principle of least privilege to limit unprivileged local access
  • Validate kernel patch levels through canonical Ubuntu update channels

Evidence notes

NVD entry cites Ubuntu kernel commit f0e73aec23d13a9877fba096b1c2fd19f66e5313 addressing the spinlock sleep bug in AppArmor SAUCE patches. CWE-833 (Deadlock) identified as relevant weakness. CVSS vector confirms local attack vector with low attack complexity and high availability impact.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-47334 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-47334

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-47334 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-47334

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.