CVE-2026-47337

What it actually does

The flaw is a locally triggerable NULL pointer dereference in Ubuntu-specific kernel SAUCE patches involved in AF_INET/AF_INET6 socket mediation. An unprivileged local user can exercise affected socket-handling paths and cause the kernel to dereference a NULL pointer, resulting in a kernel oops. The expected impact is local denial of service or instability rather than code execution, privilege escalation, or data compromise.

Why it matters to the business

A user or process with local access to an affected Ubuntu system may be able to crash or destabilize the host, causing service interruption, workload disruption, failed jobs, or required reboot/recovery. The severity is limited by the need for local access and the low availability-only impact, and there is currently no KEV listing, ransomware association, or known exploit maturity reported; however, shared servers, multi-user systems, build workers, containers with host-kernel exposure, and internet-facing services that grant shell or application-level local execution should prioritize patching to reduce outage risk.

How an attack unfolds

An attacker first needs the ability to run code locally as an unprivileged user on an affected Ubuntu Linux system. They then invoke crafted AF_INET or AF_INET6 socket operations that pass through the affected Ubuntu kernel socket mediation logic. Due to the vulnerable SAUCE patch behavior, the kernel may reach a path where it dereferences a NULL pointer. This produces a kernel oops and can degrade or interrupt system availability. Exploitation does not require user interaction and does not appear to provide confidentiality or integrity impact based on the published assessment.

How to fix it

Apply the relevant Ubuntu kernel security update as soon as Canonical publishes or has published fixed kernel packages for the affected Ubuntu releases and hardware enablement streams. Because no exact fixed versions were provided, use the distribution package manager and Canonical security advisories as the source of truth: update linux-image, linux-modules, linux-modules-extra, and related kernel metapackages, then reboot into the patched kernel. Where immediate patching is not possible, reduce exposure by limiting untrusted local accounts, restricting shell access, isolating untrusted workloads, avoiding co-tenancy on affected hosts, and using workload scheduling or container placement policies that keep untrusted code away from critical shared kernels. Mitigations cannot reliably eliminate the vulnerable kernel code path without applying a fixed kernel.

How to confirm the fix worked

Confirm whether systems are running an affected Ubuntu kernel branch and whether the currently booted kernel has been superseded by a fixed Canonical kernel package. Use package inventory and runtime checks such as `uname -r`, `dpkg -l 'linux-image*' 'linux-modules*'`, and `apt list --upgradable` or the applicable Ubuntu security advisory tooling. After updating, reboot and verify that `uname -r` reflects the patched kernel version rather than an older vulnerable kernel. Also confirm that no pending reboot remains, for example with `/var/run/reboot-required` on Ubuntu systems. To validate exposure reduction, ensure untrusted local users or workloads cannot execute arbitrary socket-triggering code on still-unpatched hosts.

Typical attack path

1. Gain local code execution on an affected Ubuntu Linux host as any low-privileged user or process.
2. Run a program or script that performs crafted IPv4 or IPv6 socket operations involving AF_INET or AF_INET6 handling.
3. Trigger the vulnerable socket mediation path in the Ubuntu kernel SAUCE patch.
4. Cause a NULL pointer dereference in kernel context.
5. Induce a kernel oops, leading to service instability, process failure, or potential host-level denial of service.

How to detect it

Review kernel and system logs for evidence of kernel oops events, NULL pointer dereferences, or crashes occurring in proximity to local user activity that creates IPv4 or IPv6 sockets. Relevant log sources include `journalctl -k`, `/var/log/kern.log`, `/var/log/syslog`, crash dump directories such as `/var/crash`, kernel dump infrastructure, EDR telemetry for local process execution, and audit logs if command/process monitoring is enabled. Look for repeated kernel warnings or oops messages mentioning NULL pointer dereference, AF_INET, AF_INET6, socket mediation, AppArmor/network mediation paths, or socket creation shortly before service interruption. Since no public exploit artifacts or actor-specific indicators are provided, detection should focus on behavioral evidence of local crash attempts and kernel fault telemetry rather than network-only indicators.

• NULL pointer dereference
• kernel NULL pointer dereference
• BUG: kernel NULL pointer dereference
• Oops:
• kernel oops
• Unable to handle kernel NULL pointer dereference
• AF_INET
• AF_INET6
• /var/log/kern.log
• /var/log/syslog
• /var/crash/
• /var/run/reboot-required

What your security team should do

• Inventory Ubuntu Linux systems running kernel versions in the affected 6.8, 6.17, and 7.0 lines, including cloud images, servers, developer workstations, build agents, and container hosts.
• Prioritize patching for multi-user hosts, bastion-like systems, CI/CD runners, container nodes, shared compute platforms, and systems running untrusted or semi-trusted workloads.
• Apply Canonical kernel updates and reboot promptly; track reboot completion because kernel package installation alone does not remove exposure from the running kernel.
• Temporarily restrict local access and untrusted workload placement on affected hosts until patched.
• Monitor kernel logs for oops or NULL pointer dereference events related to IPv4/IPv6 socket operations, especially where they coincide with activity by low-privileged users.
• Because the CVSS and EPSS are low and there is no KEV or known exploit maturity, handle through normal kernel security maintenance unless the environment has significant local multi-tenant exposure.