CVE-2026-47333: Out-of-bounds read in Ubuntu Linux AppArmor notification handling

Synopsis

An out-of-bounds heap memory read vulnerability exists in the AppArmor notification handling code in Ubuntu Linux versions 6.8, 6.17, and 7.0. The flaw is triggered locally by any unprivileged user account, requiring no network access, and causes invalid data to be fed into the AppArmor DFA policy engine. Successful exploitation gives an attacker read access to sensitive memory contents, the ability to tamper with data, and the ability to crash or destabilize the affected system. A patched-image rebuild at the fixed versions (6.8.0-124.124, 6.17.0-35.35, or 7.0.0-22.22) is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access is required to trigger the vulnerability.

• AuthenticationRequired

  Any low-privilege local user account is sufficient to trigger the notification handling code path; no elevated or administrative privileges are needed.

• Victim interactionNot required

  No action from another user or administrator is required; the attacker can trigger the bug independently.

• Attack complexityDetail

  The exploit is reliable and condition-free, with no race conditions or special environmental factors required to trigger the out-of-bounds read.

Blast Radius

• Reads arbitrary heap memory contents, which may include sensitive kernel data structures, credentials, or cryptographic material held in memory.
• Modifies or corrupts data processed by the AppArmor DFA policy engine, potentially undermining mandatory access control decisions for other processes.
• Crashes or destabilizes the affected system by causing the kernel to process invalid memory contents during AppArmor notification handling.
• Combines confidentiality loss and integrity impact to give a local attacker a strong foothold for further privilege escalation on the host.