CVE-2026-47328

Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which incorrectly attempt to free a pointer which was not previously kmalloc()d, while at the same time leaking allocated memory. The bug can be triggered by an unprivileged local user and can result in the corruption of slab metadata and could lead to resource exhaustion.

CVSS v3 6.1 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 4.2

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/noble/commit/?id=7f3c4902c39432ce7ea0d384cb70eba282247fac	Patch

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:canonical:ubuntu_linux:24.04:::::::*
	cpe:2.3:o:canonical:ubuntu_linux:25.10:::::::*
	cpe:2.3:o:canonical:ubuntu_linux:26.04:::::::*

History

No history.

Information

Published : 2026-05-28 19:16

Updated : 2026-06-17 10:54

NVD link : CVE-2026-47328

Mitre link : CVE-2026-47328

CVE.ORG link : CVE-2026-47328

JSON object : View

Products Affected

canonical

ubuntu_linux

CWE

CWE-590

Free of Memory not on the Heap

{"id": "CVE-2026-47328", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-47328", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-28T19:20:06.494860Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@ubuntu.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 4.2, "exploitabilityScore": 1.8}]}, "affected": [{"source": "security@ubuntu.com", "affectedData": [{"repo": "https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/", "vendor": "Canonical", "modules": ["AppArmor"], "product": "Ubuntu Linux", "versions": [{"status": "affected", "version": "6.8.0", "lessThan": "6.8.0-124.124", "versionType": "dpkg"}, {"status": "affected", "version": "6.17.0", "lessThan": "6.17.0-35.35", "versionType": "dpkg"}, {"status": "affected", "version": "7.0.0", "lessThan": "7.0.0-22.22", "versionType": "dpkg"}], "packageName": "linux", "collectionURL": "https://launchpad.net/ubuntu/+source/", "defaultStatus": "unaffected"}]}], "published": "2026-05-28T19:16:40.687", "references": [{"url": "https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/noble/commit/?id=7f3c4902c39432ce7ea0d384cb70eba282247fac", "tags": ["Patch"], "source": "security@ubuntu.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@ubuntu.com", "description": [{"lang": "en", "value": "CWE-590"}]}], "descriptions": [{"lang": "en", "value": "Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which incorrectly attempt to free a pointer which was not previously kmalloc()d, while at the same time leaking allocated memory. The bug can be triggered by an unprivileged local user and can result in the corruption of slab metadata and could lead to resource exhaustion."}], "lastModified": "2026-06-17T10:54:31.043", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:canonical:ubuntu_linux:24.04:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "62D1BEC7-1A71-4991-A1A5-0E3D282100EC"}, {"criteria": "cpe:2.3:o:canonical:ubuntu_linux:25.10:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "68D562DD-F22D-4310-93C7-7DE817104CAC"}, {"criteria": "cpe:2.3:o:canonical:ubuntu_linux:26.04:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2BB2642A-AA54-4949-A9FC-0E9673539350"}], "operator": "OR"}]}], "sourceIdentifier": "security@ubuntu.com"}