CVE-2026-47328

What it actually does

This vulnerability is a local kernel memory corruption issue in Ubuntu Linux kernels carrying AppArmor SAUCE patches. An unprivileged local user can trigger faulty AppArmor code that attempts to free memory not allocated with kmalloc() while also leaking allocated memory. The result can corrupt slab allocator metadata and may cause resource exhaustion, kernel instability, denial of service, and potentially limited integrity impact if the memory corruption can be shaped reliably. The attack requires local code execution or a local user account and does not provide a remote network entry point by itself.

Why it matters to the business

Successful exploitation could allow a low-privileged local user or compromised application workload to destabilize affected Ubuntu systems, causing outages, crashes, or degraded service availability. Because the impact is primarily local denial of service with possible kernel memory corruption, the business risk is highest for multi-user systems, shared compute platforms, container hosts, developer workstations, and internet-facing services where an attacker may first gain limited local execution. The vulnerability is not currently listed in CISA KEV, has very low EPSS, and has no reported exploit maturity, which lowers immediate mass-exploitation urgency; however, kernel flaws should still be remediated promptly because they can become useful post-compromise primitives.

How an attack unfolds

An attacker first needs a foothold that allows execution as an unprivileged local user on an affected Ubuntu system. From there, the attacker interacts with AppArmor-related kernel functionality in a way that reaches the vulnerable SAUCE patch code path. The flawed code mishandles memory ownership, attempting to free a pointer that was not allocated by the expected kernel allocator and leaking other allocations. Repeated or carefully timed triggering can corrupt slab allocator metadata or consume kernel memory. In practical terms, exploitation is most likely to be used to crash the host, degrade service availability, or potentially create unreliable memory-corruption conditions that could be explored for further privilege-impact research. There is no indication from the provided intelligence that public exploitation or named threat actor activity is currently associated with this issue.

How to fix it

Apply the Ubuntu kernel security update that corrects the AppArmor memory-management flaw for the affected kernel series. Because no exact fixed versions were provided, use Canonical/Ubuntu security advisories and package repositories to identify the patched kernel package for each supported release and kernel stream. After installation, reboot into the patched kernel and remove or de-prioritize vulnerable kernels from the bootloader where operationally appropriate. Where immediate patching is not possible, reduce exposure by limiting local shell access, restricting untrusted workloads, enforcing least privilege, isolating multi-tenant workloads, monitoring for kernel instability or AppArmor errors, and disabling nonessential paths that allow untrusted users to exercise AppArmor policy operations. Mitigation should not be considered equivalent to patching because the flaw is in kernel memory handling.

How to confirm the fix worked

Verify the running kernel version after reboot using standard OS inventory commands and confirm it corresponds to a Canonical-patched kernel for the applicable Ubuntu release. Confirm package-manager metadata shows the kernel image, kernel modules, and related signed kernel packages are updated. Ensure the system is actually booted into the updated kernel, not merely that the package is installed. Review bootloader entries for older vulnerable kernels and remove them where policy allows. Validate AppArmor remains enabled and functioning after the update, and review system logs for absence of recurring AppArmor-related kernel warnings, slab allocator errors, memory allocation failures, kernel oops messages, or unexpected reboots under normal workload.

Typical attack path

1. Obtain local execution on an affected Ubuntu Linux system, such as through a compromised account, vulnerable application, container escape prerequisite, or interactive shell.
2. Confirm the system is running an affected Ubuntu kernel with the vulnerable AppArmor SAUCE patches present.
3. Invoke AppArmor-related operations that reach the vulnerable kernel code path from a low-privileged context.
4. Trigger the invalid free and memory leak condition repeatedly or under controlled timing.
5. Cause kernel slab metadata corruption, memory pressure, service degradation, or a system crash.
6. Optionally use resulting instability as part of a broader post-compromise attack chain, though reliable privilege escalation is not established from the provided information.

How to detect it

To determine whether this vulnerability may have been exploited, focus on host-level and kernel telemetry rather than network indicators, because exploitation requires local access. Review kernel logs, system journal, crash dumps, AppArmor logs, audit logs, and uptime/reboot history for unexplained kernel oops, panic, slab allocator corruption, invalid free warnings, memory allocation failures, out-of-memory events, or AppArmor-related errors occurring before crashes or service disruption. Correlate suspicious events with local user sessions, sudo activity, cron/systemd timer execution, container workloads, CI jobs, or newly created processes running under low-privileged accounts. Check for repeated triggering patterns, such as many AppArmor policy operations shortly before memory pressure or kernel instability. If kernel crash dumps are available, inspect stack traces for AppArmor-related functions and slab allocator diagnostics. There are no unique public exploit strings or network signatures derivable from the provided intelligence, so detection should rely on behavioral evidence of local triggering and kernel memory corruption.

• kernel: BUG: unable to handle kernel
• kernel: general protection fault
• kernel: kernel BUG at
• kernel: Oops:
• kernel: panic
• kernel: slab corruption
• kernel: Slab corruption
• kernel: bad free
• kernel: invalid free
• kernel: KASAN: bad-free
• kernel: KASAN: use-after-free
• kernel: kmem_cache_free
• kernel: out of memory
• kernel: Out of memory
• kernel: page allocation failure
• audit: type=1400
• apparmor="DENIED"
• apparmor="ALLOWED"
• apparmor_parser
• /var/log/kern.log
• /var/log/syslog
• /var/log/audit/audit.log
• /var/crash/
• /var/lib/systemd/coredump/

What your security team should do

• Inventory Ubuntu systems and identify those running affected kernel streams with AppArmor enabled or AppArmor SAUCE patches present.
• Prioritize patching shared, multi-user, container-hosting, CI/CD, developer, and internet-facing systems where local code execution by less-trusted users is plausible.
• Apply the relevant Ubuntu kernel security updates and reboot systems into the fixed kernel.
• Confirm older vulnerable kernels are not still the active boot target and are not retained indefinitely as default fallback entries.
• Increase monitoring for kernel oops, panic, slab corruption, out-of-memory, and AppArmor-related anomalies until patching is complete.
• Review local access controls and reduce unnecessary shell access or untrusted workload execution on affected hosts.
• Treat any unexplained host crashes or kernel memory-corruption events on affected systems as potentially suspicious and preserve logs for forensic review.