CVE-2026-47327
Description
Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches with a possible NULL pointer dereference in the handling of AppArmor notifications. The bug can be triggered by an unprivileged local user. This can lead to a kernel oops.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
A NULL pointer dereference in Ubuntu's AppArmor notification handling allows unprivileged local users to trigger a kernel oops.
Vulnerability
A NULL pointer dereference exists in the knotif_update_from_uresp_name function in security/apparmor/notify.c of the Ubuntu Linux kernel (versions 6.8, 6.17, and 7.0 with SAUCE patches). The bug occurs when handling AppArmor notifications and can be triggered by an unprivileged local user without special permissions [1].
Exploitation
An attacker with local unprivileged access can trigger the vulnerable code path by sending crafted AppArmor notifications. No authentication beyond a local user account is required. The exact sequence involves invoking the notification handling routine that leads to a NULL pointer dereference [1].
Impact
Successful exploitation causes a kernel oops, resulting in a denial of service (system crash). No privilege escalation or data compromise is described in the available references [1].
Mitigation
The fix is included in the Ubuntu kernel commit 7f3c4902c39432ce7ea0d384cb70eba282247fac, which was applied to the noble kernel tree on 2026-04-22 and merged on 2026-05-22 [1]. Users should update to a kernel version containing this commit. No workarounds are documented.
AI Insight generated on May 28, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
Synthesis attempt was rejected by the grounding validator. Re-run pending.
References
1News mentions
0No linked articles in our index yet.