Executive brief
A security vulnerability exists in the Ubuntu Linux kernel's AppArmor component, which is used to restrict the capabilities of programs. An unprivileged local user could exploit this flaw to read sensitive information from the system's memory that they should not have access to. This could lead to the exposure of private data or help an attacker bypass other security protections.
Technical details
An out-of-bounds read vulnerability exists in the AppArmor notification handling code within Ubuntu-specific kernel patches (SAUCE patches). The root cause is a size validation error in 'security/apparmor/apparmorfs.c' where 'sizeof()' was applied to a pointer ('unotif') instead of the underlying 'struct apparmor_notif_filter' structure. A local, unprivileged attacker can trigger this by providing a specially crafted size value to the 'notify_set_filter' function. This allows the attacker to read data from adjacent slab objects in kernel memory, potentially leading to information disclosure. The issue has been addressed in the Ubuntu kernel source by correcting the 'sizeof' check to reference the dereferenced pointer.
Affected products
- Ubuntu Linux Kernel (Ubuntu) 6.8, 6.17, 7.0
Timeline
- 2026-04-22: other: Fix authored by Georgia Garcia
- 2026-05-22: patched: Fix committed to Ubuntu kernel tree
- 2026-05-28: disclosed: CVE published