PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-47336 Canonical CVE debrief

A use-of-uninitialized-variable flaw exists in Ubuntu's SAUCE-patched Linux 6.8 kernel within the AppArmor LSM's AF_INET/AF_INET6 socket mediation path. The bug can be triggered by an unprivileged local user and may cause AppArmor to apply incorrect fine-grained network-socket mediation decisions. The vulnerability was introduced via Ubuntu-specific SAUCE patches and is not present in upstream Linux. The CVSS 3.1 score is 3.3 (Low), reflecting local attack vector, low attack complexity, low privileges required, and low integrity impact with no confidentiality or availability impact.

Vendor
Canonical
Product
Ubuntu Linux
CVSS
LOW 3.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-05-29
Advisory published
2026-05-28
Advisory updated
2026-05-29

Who should care

Organizations running Ubuntu systems with Linux 6.8 kernel and AppArmor enabled; security teams responsible for mandatory access control enforcement; compliance teams monitoring for LSM bypass vulnerabilities.

Technical summary

The vulnerability resides in Ubuntu's SAUCE (Ubuntu-specific) patches to Linux 6.8, specifically in the AppArmor security module's handling of AF_INET and AF_INET6 socket operations. An uninitialized variable in the socket mediation code path can lead to incorrect security decisions when AppArmor evaluates network socket access requests. Because AppArmor is a Linux Security Module (LSM) that provides mandatory access control, a flaw in its mediation logic could allow unintended network access that should be restricted by policy. The attack requires local unprivileged access to trigger the vulnerable code path. The integrity impact is rated Low as the flaw may cause incorrect policy enforcement rather than direct code execution or data disclosure.

Defensive priority

Low

Recommended defensive actions

  • Review Ubuntu security notices for kernel updates addressing CVE-2026-47336
  • Apply Ubuntu kernel security updates when available per standard patch management cycle
  • Verify AppArmor profiles are correctly enforcing network socket restrictions on affected systems
  • Monitor for anomalous network socket behavior that may indicate mediation bypass attempts

Evidence notes

NVD entry lists vulnerability status as 'Received'. Ubuntu kernel commit reference provided via [email protected]. CWE-457 (Use of Uninitialized Variable) assigned. CVSS vector confirms local attack scope with integrity impact only.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-47336 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-47336

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-47336 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-47336

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.