PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-47337 Canonical CVE debrief

A NULL pointer dereference vulnerability exists in Ubuntu Linux kernel versions 6.8, 6.17, and 7.0 within SAUCE patches handling AF_INET/AF_INET6 socket mediation. An unprivileged local user can trigger this flaw, resulting in a kernel oops (denial of service). The vulnerability is classified as LOW severity with a CVSS 3.1 score of 3.3. The issue was published on 2026-05-28 and is tracked as CWE-476. No known exploitation in the wild or ransomware campaign use has been reported.

Vendor
Canonical
Product
Ubuntu Linux
CVSS
LOW 3.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-05-29
Advisory published
2026-05-28
Advisory updated
2026-05-29

Who should care

System administrators managing Ubuntu Linux deployments with kernel versions 6.8, 6.17, or 7.0; security teams tracking local privilege escalation and denial-of-service vectors in Linux kernels; organizations with multi-user Ubuntu systems where unprivileged local access is available.

Technical summary

The vulnerability stems from SAUCE (Ubuntu-specific) patches in the Linux kernel that mishandle socket mediation for IPv4 (AF_INET) and IPv6 (AF_INET6) sockets. A NULL pointer dereference can occur during this mediation process. The attack vector is local, requiring low privileges and no user interaction. Successful exploitation causes a kernel oops, resulting in availability impact only. The CVSS vector is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L.

Defensive priority

routine

Recommended defensive actions

  • Apply kernel updates from Ubuntu when available, prioritizing systems running affected versions 6.8, 6.17, or 7.0
  • Monitor Ubuntu Security Notices for patch availability
  • Review local user access controls to reduce attack surface from unprivileged accounts
  • Consider enabling kernel crash dumping to capture diagnostic information if oops occurs

Evidence notes

The vulnerability description and affected versions are derived from the official CVE record and NVD entry. The commit reference from Launchpad provides technical context for the SAUCE patch issue. Vendor attribution is marked as low confidence pending review, with Launchpad identified as the reference domain candidate.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-47337 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-47337

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-47337 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-47337

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.