CVE-2026-47331: Use-after-free in Ubuntu Linux AppArmor notification handling

Synopsis

A use-after-free vulnerability exists in the AppArmor notification handling code in Ubuntu Linux 6.8, introduced via Canonical SAUCE patches that fail to acquire a lock before modifying a linked list. The flaw is reachable locally by any unprivileged user without network access or elevated privileges, exploiting the resulting race condition. Successful exploitation gives an attacker full read, write, and execution control over the affected system, up to and including arbitrary code execution. A patched-image rebuild at version 6.8.0-124.124 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access to the target is required.

• AuthenticationRequired

  Any low-privilege local user account is sufficient to trigger the race condition; no elevated or administrative credentials are needed.

• Victim interactionNot required

  No user interaction is needed; the attacker can trigger the vulnerable code path entirely on their own.

• Attack complexityDetail

  Although the underlying bug is a race condition, the CVSS vector rates attack complexity as low, meaning the exploit is considered reliable and does not depend on specific memory layouts or uncommon environmental conditions.

Blast Radius

• A successful attacker reads arbitrary kernel memory, including stored credentials, session tokens, and secrets held in other processes.
• The attacker writes to arbitrary kernel memory, allowing modification of security policies, process credentials, or persisted data.
• The attacker achieves arbitrary code execution at the kernel level, giving full control over the host and any workloads running on it.
• All confidentiality, integrity, and availability guarantees for the affected host are lost once the vulnerability is exploited.