CVE-2026-47328

Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which incorrectly attempt to free a pointer which was not previously kmalloc()d, while at the same time leaking allocated memory. The bug can be triggered by an unprivileged local user and can result in the corruption of slab metadata and could lead to resource exhaustion.

CVSS v3 6.1 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 4.2

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/noble/commit/?id=7f3c4902c39432ce7ea0d384cb70eba282247fac	Patch

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:canonical:ubuntu_linux:24.04:::::::*
	cpe:2.3:o:canonical:ubuntu_linux:25.10:::::::*
	cpe:2.3:o:canonical:ubuntu_linux:26.04:::::::*

History

26 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) Ubuntu Linux 6.8, 6.17 y 7.0 contienen parches SAUCE de AppArmor que intentan liberar incorrectamente un puntero que no había sido previamente asignado con kmalloc(), mientras que, al mismo tiempo, fugan memoria asignada. El error puede ser activado por un usuario local sin privilegios y puede resultar en la corrupción de los metadatos de slab y podría llevar al agotamiento de recursos.

Information

Published : 2026-05-28 19:16

Updated : 2026-10-26 13:10

NVD link : CVE-2026-47328

Mitre link : CVE-2026-47328

CVE.ORG link : CVE-2026-47328

JSON object : View

Products Affected

canonical

ubuntu_linux

CWE

CWE-590

Free of Memory not on the Heap

{"id": "CVE-2026-47328", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-47328", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-28T19:20:06.494860Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@ubuntu.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 4.2, "exploitabilityScore": 1.8}]}, "affected": [{"source": "security@ubuntu.com", "affectedData": [{"repo": "https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/", "vendor": "Canonical", "modules": ["AppArmor"], "product": "Ubuntu Linux", "versions": [{"status": "affected", "version": "6.8.0", "lessThan": "6.8.0-124.124", "versionType": "dpkg"}, {"status": "affected", "version": "6.17.0", "lessThan": "6.17.0-35.35", "versionType": "dpkg"}, {"status": "affected", "version": "7.0.0", "lessThan": "7.0.0-22.22", "versionType": "dpkg"}], "packageName": "linux", "collectionURL": "https://launchpad.net/ubuntu/+source/", "defaultStatus": "unaffected"}]}], "published": "2026-05-28T19:16:40.687", "references": [{"url": "https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/noble/commit/?id=7f3c4902c39432ce7ea0d384cb70eba282247fac", "tags": ["Patch"], "source": "security@ubuntu.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@ubuntu.com", "description": [{"lang": "en", "value": "CWE-590"}]}], "descriptions": [{"lang": "en", "value": "Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which incorrectly attempt to free a pointer which was not previously kmalloc()d, while at the same time leaking allocated memory. The bug can be triggered by an unprivileged local user and can result in the corruption of slab metadata and could lead to resource exhaustion."}, {"lang": "es", "value": "Ubuntu Linux 6.8, 6.17 y 7.0 contienen parches SAUCE de AppArmor que intentan liberar incorrectamente un puntero que no hab\u00eda sido previamente asignado con kmalloc(), mientras que, al mismo tiempo, fugan memoria asignada. El error puede ser activado por un usuario local sin privilegios y puede resultar en la corrupci\u00f3n de los metadatos de slab y podr\u00eda llevar al agotamiento de recursos."}], "lastModified": "2026-10-26T13:10:00.140", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:canonical:ubuntu_linux:24.04:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "62D1BEC7-1A71-4991-A1A5-0E3D282100EC"}, {"criteria": "cpe:2.3:o:canonical:ubuntu_linux:25.10:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "68D562DD-F22D-4310-93C7-7DE817104CAC"}, {"criteria": "cpe:2.3:o:canonical:ubuntu_linux:26.04:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2BB2642A-AA54-4949-A9FC-0E9673539350"}], "operator": "OR"}]}], "sourceIdentifier": "security@ubuntu.com"}