CVE-2026-47328

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-47328", "assignerOrgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "state": "PUBLISHED", "assignerShortName": "canonical", "dateReserved": "2026-05-19T10:37:36.433Z", "datePublished": "2026-05-28T18:27:33.181Z", "dateUpdated": "2026-05-28T19:25:13.160Z"}, "containers": {"cna": {"title": "Invalid pointer deallocation in Ubuntu Linux AppArmor notification handling", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-590", "description": "CWE-590 Free of memory not on the heap", "type": "CWE"}]}], "affected": [{"vendor": "Canonical", "product": "Ubuntu Linux", "collectionURL": "https://launchpad.net/ubuntu/+source/", "packageName": "linux", "repo": "https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/", "modules": ["AppArmor"], "versions": [{"status": "affected", "version": "6.8.0", "lessThan": "6.8.0-124.124", "versionType": "dpkg"}, {"status": "affected", "version": "6.17.0", "lessThan": "6.17.0-35.35", "versionType": "dpkg"}, {"status": "affected", "version": "7.0.0", "lessThan": "7.0.0-22.22", "versionType": "dpkg"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which incorrectly attempt to free a pointer which was not previously kmalloc()d, while at the same time leaking allocated memory. The bug can be triggered by an unprivileged local user and can result in the corruption of slab metadata and could lead to resource exhaustion."}], "references": [{"url": "https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/noble/commit/?id=7f3c4902c39432ce7ea0d384cb70eba282247fac", "tags": ["patch"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "HIGH", "baseSeverity": "MEDIUM", "baseScore": 6.1, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H"}}], "credits": [{"lang": "en", "value": "Tristan Madani (@TristanInSec), Talence Security", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "providerMetadata": {"orgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "shortName": "canonical", "dateUpdated": "2026-05-28T18:27:33.181Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-28T19:20:06.494860Z", "id": "CVE-2026-47328", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-28T19:25:13.160Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-47328", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-28T19:20:06.494860Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-28T19:25:08.685Z"}}], "cna": {"title": "Invalid pointer deallocation in Ubuntu Linux AppArmor notification handling", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Tristan Madani (@TristanInSec), Talence Security"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/", "vendor": "Canonical", "modules": ["AppArmor"], "product": "Ubuntu Linux", "versions": [{"status": "affected", "version": "6.8.0", "lessThan": "6.8.0-124.124", "versionType": "dpkg"}, {"status": "affected", "version": "6.17.0", "lessThan": "6.17.0-35.35", "versionType": "dpkg"}, {"status": "affected", "version": "7.0.0", "lessThan": "7.0.0-22.22", "versionType": "dpkg"}], "packageName": "linux", "collectionURL": "https://launchpad.net/ubuntu/+source/", "defaultStatus": "unaffected"}], "references": [{"url": "https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/noble/commit/?id=7f3c4902c39432ce7ea0d384cb70eba282247fac", "tags": ["patch"]}], "descriptions": [{"lang": "en", "value": "Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which incorrectly attempt to free a pointer which was not previously kmalloc()d, while at the same time leaking allocated memory. The bug can be triggered by an unprivileged local user and can result in the corruption of slab metadata and could lead to resource exhaustion."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-590", "description": "CWE-590 Free of memory not on the heap"}]}], "providerMetadata": {"orgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "shortName": "canonical", "dateUpdated": "2026-05-28T18:27:33.181Z"}}}, "cveMetadata": {"cveId": "CVE-2026-47328", "state": "PUBLISHED", "dateUpdated": "2026-05-28T19:25:13.160Z", "dateReserved": "2026-05-19T10:37:36.433Z", "assignerOrgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "datePublished": "2026-05-28T18:27:33.181Z", "assignerShortName": "canonical"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://launchpad.net/ubuntu/+source/", "defaultStatus": "unaffected", "modules": ["AppArmor"], "packageName": "linux", "product": "Ubuntu Linux", "repo": "https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/", "vendor": "Canonical", "versions": [{"lessThan": "6.8.0-124.124", "status": "affected", "version": "6.8.0", "versionType": "dpkg"}, {"lessThan": "6.17.0-35.35", "status": "affected", "version": "6.17.0", "versionType": "dpkg"}, {"lessThan": "7.0.0-22.22", "status": "affected", "version": "7.0.0", "versionType": "dpkg"}]}], "source": "security@ubuntu.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:canonical:ubuntu_linux:24.04:*:*:*:*:*:*:*", "matchCriteriaId": "62D1BEC7-1A71-4991-A1A5-0E3D282100EC", "vulnerable": true}, {"criteria": "cpe:2.3:o:canonical:ubuntu_linux:25.10:*:*:*:*:*:*:*", "matchCriteriaId": "68D562DD-F22D-4310-93C7-7DE817104CAC", "vulnerable": true}, {"criteria": "cpe:2.3:o:canonical:ubuntu_linux:26.04:*:*:*:*:*:*:*", "matchCriteriaId": "2BB2642A-AA54-4949-A9FC-0E9673539350", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which incorrectly attempt to free a pointer which was not previously kmalloc()d, while at the same time leaking allocated memory. The bug can be triggered by an unprivileged local user and can result in the corruption of slab metadata and could lead to resource exhaustion."}, {"lang": "es", "value": "Ubuntu Linux 6.8, 6.17 y 7.0 contienen parches SAUCE de AppArmor que intentan liberar incorrectamente un puntero que no hab\u00eda sido previamente asignado con kmalloc(), mientras que, al mismo tiempo, fugan memoria asignada. El error puede ser activado por un usuario local sin privilegios y puede resultar en la corrupci\u00f3n de los metadatos de slab y podr\u00eda llevar al agotamiento de recursos."}], "id": "CVE-2026-47328", "lastModified": "2026-10-26T13:10:00.140", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 4.2, "source": "security@ubuntu.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-47328", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-28T19:20:06.494860Z", "version": "2.0.3"}}]}, "published": "2026-05-28T19:16:40.687", "references": [{"source": "security@ubuntu.com", "tags": ["Patch"], "url": "https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/noble/commit/?id=7f3c4902c39432ce7ea0d384cb70eba282247fac"}], "sourceIdentifier": "security@ubuntu.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-590"}], "source": "security@ubuntu.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.8.0,6.8.0-124.124)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.17.0,6.17.0-35.35)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.0.0,7.0.0-22.22)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Ubuntu Linux", "source": "cna", "vendor": "Canonical"}, "product": "ubuntu_linux", "vendor": "canonical"}], "created": "2026-05-28T20:30:25.992549+00:00", "updated": "2026-05-28T21:00:15.730940+00:00", "vendors": ["canonical", "canonical$PRODUCT$ubuntu_linux"]}