Executive brief
A vulnerability exists in specific versions of the Ubuntu Linux kernel affecting AppArmor, a security system that restricts what programs can do. An unprivileged user on the system can trigger a memory leak by sending specific large responses to security notifications. Over time, this can exhaust the system's available memory, leading to a slowdown or a complete system crash (denial of service).
Technical details
A memory leak exists in the AppArmor implementation within Ubuntu-specific 'SAUCE' kernel patches. The vulnerability is caused by an inverted NULL check in the `notify_user_response` function in `security/apparmor/apparmorfs.c` after a call to `aa_get_buffer`. When a large response is processed, the code incorrectly returns an -ENOMEM error and fails to release the buffer if the allocation actually succeeded. A local, unprivileged attacker can exploit this by repeatedly triggering large AppArmor notifications, leading to kernel memory exhaustion and a denial of service. A fix has been committed to the Ubuntu kernel tree to correctly invert the logic check.
Affected products
- Ubuntu Linux Kernel 6.8, 6.17, 7.0
Timeline
- 2026-04-22: other: Fix authored by Georgia Garcia
- 2026-05-22: other: Fix committed to Ubuntu kernel tree
- 2026-05-28: disclosed: CVE published