Ubuntu Linux kernel 6.8 contains a race condition in the AppArmor SAUCE notification handling code. When the code modifies a linked list it fails to acquire the necessary lock, allowing an unprivileged local user to trigger a use‑after‑free. If exploited, the attacker could potentially execute arbitrary code with the privileges of the affected process, undermining confidentiality, integrity, and availability of the system.

The vulnerability is present in Canonical’s Ubuntu Linux distribution, specifically in the 6.8 kernel series. Users of this kernel, especially those running unprivileged local accounts, are susceptible until the patch is applied.

The CVSS score is 7.8, indicating a high severity. The EPSS score is not available, so the likelihood of opportunistic exploitation cannot be precisely quantified, but the vulnerability is not currently listed in the CISA KEV catalogue. Because the attack requires local execution, a compromised or malicious local user can trigger the race condition; the lack of a proper lock on the linked list provides the necessary window for the use‑after‑free.