Technical impact
This vulnerability is caused by an uninitialized variable in the AppArmor notification handling code of the Ubuntu Linux kernel. An unprivileged local user can trigger the bug, which leads to incorrect caching of AppArmor notification responses. Because the affected data are stored in cache, the flaw may allow a local attacker to influence policy enforcement in ways that were not intended by the system designers. The weakness is classified as CWE‑457, an uninitialized variable error.
Affected Systems
The issue affects Ubuntu Linux kernel releases 6.8, 7.17 and 7.0 built by Canonical that contain the AppArmor SAUCE patches. The flaw is present until the kernel code is updated to include the patch identified by the reference commit.
Risk and Exploitability
The CVSS score of 3.3 indicates a low overall severity, and the EPSS score is not available. The vulnerability is exploitable locally by an unprivileged user, who can trigger the bug through normal use of the system. No publicly disclosed exploits are known and the vulnerability is not listed in the CISA KEV catalog, which reduces the immediate threat. Nevertheless, because the flaw can undermine AppArmor policy enforcement, it should be treated as low‑to‑moderate risk until patched.
Ubuntu USN