Executive brief
A security vulnerability exists in specific versions of the Ubuntu Linux kernel involving AppArmor, a security system that restricts what programs can do. An unprivileged local user could provide specially crafted responses to AppArmor notifications that bypass certain name validation checks. While the impact is limited, it could allow a user to interfere with how the system handles security policy notifications.
Technical details
A vulnerability in the AppArmor notification component of Ubuntu-specific kernel patches (SAUCE) allows for a validation bypass. The function 'response_is_valid_name' in 'security/apparmor/notify.c' incorrectly returned negative error codes (like -EINVAL) instead of a boolean 'false'. Because C interprets non-zero integers as 'true', these error conditions were treated as successful validations. An unprivileged local attacker can exploit this by providing crafted notification responses with invalid name field sizes or offsets. This issue is addressed by updating the function to return proper boolean values.
Affected products
- Ubuntu Linux Kernel (Ubuntu SAUCE patches) 6.8, 6.17, 7.0
Timeline
- 2026-04-22: other: Patch authored by Georgia Garcia
- 2026-05-22: patched: Patch committed to Ubuntu kernel tree
- 2026-05-28: disclosed: CVE published