CVE-2026-47331— Use-after-free in Ubuntu Linux AppArmor notification handling
Quick assessment
Affected
Canonical Ubuntu Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Canonical Ubuntu Linux是英国科能软件（Canonical）公司的一套Linux操作系统。 Canonical Ubuntu Linux 6.8版本存在安全漏洞，该漏洞源于修改链表时未获取锁，可能导致竞争条件触发释放后重用，理论上可导致任意代码执行。
Possible ATT&CK Techniques 1 AI
T1203 · Exploitation for Client ExecutionAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Canonical | Ubuntu Linux | 6.8.0< 6.8.0-124.124 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-47331
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Use-after-free in Ubuntu Linux AppArmor notification handling
Source: CVE Program / CVE List V5
Vulnerability Description
Ubuntu Linux 6.8 contains AppArmor SAUCE patches which fail to acquire a lock when modifying a linked list. An unprivileged local user could trigger the race condition that can lead to a use-after-free (UAF) and, theoretically, arbitrary code execution.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
释放后使用
Source: CVE Program / CVE List V5
Vulnerability Title
Canonical Ubuntu Linux 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Canonical Ubuntu Linux是英国科能软件（Canonical）公司的一套Linux操作系统。 Canonical Ubuntu Linux 6.8版本存在安全漏洞，该漏洞源于修改链表时未获取锁，可能导致竞争条件触发释放后重用，理论上可导致任意代码执行。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Canonical | Ubuntu Linux | 6.8.0 ~ 6.8.0-124.124 | - |
|
II. Public POCs for CVE-2026-47331
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-47331
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-47331 (1)
Same Patch Batch · Canonical · 2026-05-28 · 14 CVEs total
| CVE-2026-49238 | 8.4 HIGH | SFTP Server VM Escape in Canonical Multipass |
| CVE-2026-49237 | 7.8 HIGH | Local Privilege Escalation in Canonical Multipass |
| CVE-2026-47333 | 7.8 HIGH | Out-of-bounds read in Ubuntu Linux AppArmor notification handling |
| CVE-2026-47328 | 6.1 MEDIUM | Invalid pointer deallocation in Ubuntu Linux AppArmor notification handling |
| CVE-2026-47332 | 5.5 MEDIUM | Out-of-bounds read in Ubuntu Linux AppArmor notification handling |
| CVE-2026-47334 | 5.5 MEDIUM | Deadlock or kernel panic in Ubuntu Linux AppArmor notification handling |
| CVE-2026-47326 | 5.5 MEDIUM | Memory leak in Ubuntu Linux AppArmor large notification response allocation |
| CVE-2026-47335 | 5.5 MEDIUM | NULL pointer dereference in Ubuntu Linux AppArmor notification handling |
| CVE-2026-47336 | 3.3 LOW | Use of uninitialized value in Ubuntu Linux AppArmor IPv4/IPv6 socket mediation rules |
| CVE-2026-47327 | 3.3 LOW | NULL pointer dereference in Ubuntu Linux AppArmor notification handling |
| CVE-2026-47337 | 3.3 LOW | NULL pointer dereference in Ubuntu Linux AppArmor IPv4/IPv6 socket mediation |
| CVE-2026-47330 | 3.3 LOW | Use of uninitialized value in Ubuntu Linux AppArmor notification handling |
| CVE-2026-47329 | 3.3 LOW | Incorrect validation of field size in Ubuntu Linux AppArmor notification responses |
IV. Related Vulnerabilities
Same product: Ubuntu Linux
-
CVE-2026-47337
NULL pointer dereference in Ubuntu Linux AppArmor IPv4/IPv6 -
CVE-2026-47336
Use of uninitialized value in Ubuntu Linux AppArmor IPv4/IPv -
CVE-2026-47335
NULL pointer dereference in Ubuntu Linux AppArmor notificati -
CVE-2026-47334
Deadlock or kernel panic in Ubuntu Linux AppArmor notificati -
CVE-2026-47333
Out-of-bounds read in Ubuntu Linux AppArmor notification han
Same vendor: Canonical
-
CVE-2026-102371
wsl-pro-service: Ubuntu Pro token exposed via process comman -
CVE-2026-87798
LXD client recursive file pull allows directory escape via m -
CVE-2026-87799
Arbitrary file write on LXD host via symlink in migration st -
CVE-2026-97335
Incorrect authorization in LXD storage volume API allows rea -
CVE-2026-85185
Path traversal in LXD btrfs storage driver allows arbitrary
Same weakness: CWE-416
-
CVE-2026-73637
Apache HTTP Server: mod_auth_digest DoS attack -
CVE-2026-57941
Apache HTTP Server: mod_http2 use-after-free / wild write vi -
CVE-2026-56154
Apache HTTP Server: mod_rewrite use-after-free via %{LA-U:HT -
CVE-2026-103679
Tnef: use-after-free and double-free in get_body_files() via -
CVE-2026-101276
iperf3 3.21远程堆释放后使用漏洞
V. Comments for CVE-2026-47331
No comments yet