An incorrect buffer size calculation in the AppArmor SAUCE patches of Ubuntu Linux kernels 6.8, 6.17, and 7.0 enables a heap out‑of‑bounds read during notification handling. The flaw allows an unprivileged local user to read arbitrary heap data, which is then passed to the AppArmor DFA policy engine. This can expose sensitive information or corrupt policy evaluation, thereby compromising the confidentiality of local data and the integrity of the AppArmor decision engine.

The vulnerability impacts Canonical Ubuntu Linux systems that incorporate kernel versions 6.8, 6.17, or 7.0 with the AppArmor SAUCE patches. No additional sub‑version constraints are listed, so all builds containing these kernel releases are affected.

The CVSS score of 7.8 indicates high severity, while the EPSS score is unavailable, so the exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog, suggesting no publicly documented exploits. Attackers must execute the flaw from a local account without elevated privileges; no external or privilege escalation vector is required. Triggering the notification handling path to read beyond the buffer boundary is the core exploitation technique, achievable by interacting with AppArmor policies or related processes.