Canonical Ltd. — recent CVEs https://vulnogram.org/ Most recent CVEs assigned by Canonical Ltd. (canonical). https://vulnogram.org/seaview/icons/canonical.png Canonical Ltd. — recent CVEs https://vulnogram.org/ Wed, 21 Oct 2026 07:00:06 GMT CVE-2026-102631 · 5.9 MEDIUM — authd: Account takeover via username fallback in identity matching after IdP email reassignment https://vulnogram.org/CVE-2026-102631 https://vulnogram.org/CVE-2026-102631 In authd before 0.7.1, the user identity matching in UpdateUser (internal/users/manager.go) resolves an incoming login by the broker-scoped provider ID, but falls back to matching the username when the provider ID does not belong to any known user, a… Medium Thu, 15 Oct 2026 16:42:19 GMT CVE-2026-104055 · 5.3 MEDIUM — Monitoring-user password logged in cleartext by postgres_exporter in postgresql VM charm https://vulnogram.org/CVE-2026-104055 https://vulnogram.org/CVE-2026-104055 The postgresql-operator charm runs a Prometheus postgres_exporter to collect database metrics using a dedicated "monitoring" PostgreSQL user. On database connection errors, the exporter writes the monitoring user's password in cleartext to its logs.… Medium Fri, 02 Oct 2026 20:35:50 GMT CVE-2026-12392 · 5.3 MEDIUM 🌩️ — RPC secret disclosure via vendor data endpoint in Canonical MAAS https://vulnogram.org/CVE-2026-12392 https://vulnogram.org/CVE-2026-12392 An information exposure vulnerability in Canonical MAAS prior to versions 3.4.10, 3.5.14, 3.6.5, 3.7.3, and 3.8.0 allows an unauthenticated attacker to retrieve the RPC secret in plaintext via the vendor data metadata endpoint. If a target machine wa… Medium Network Exploitable Fri, 02 Oct 2026 19:24:09 GMT CVE-2026-97876 · 6.4 MEDIUM — Bypass of GRUB lockdown restriction in Secure Boot mode via serial command MMIO base address https://vulnogram.org/CVE-2026-97876 https://vulnogram.org/CVE-2026-97876 A local attacker with control over GRUB's configuration can bypass lockdown restrictions when booting with Secure Boot and load an unsigned GRUB module, while GRUB continues to report lockdown is enabled. The vulnerability is caused by insufficient v… Medium Fri, 02 Oct 2026 10:34:23 GMT CVE-2026-102371 · 5.7 MEDIUM — wsl-pro-service: Ubuntu Pro token exposed via process command-line arguments https://vulnogram.org/CVE-2026-102371 https://vulnogram.org/CVE-2026-102371 In wsl-pro-service before 0.1.19ubuntu3, the service component which runs as root inside each WSL instance attaches the instance to Ubuntu Pro by executing the pro client with the Ubuntu Pro token passed as a command-line argument (pro attach <token>… Medium Tue, 29 Sep 2026 14:11:19 GMT CVE-2024-42002 · 8.6 HIGH — Unsafe use of eval() method in ros2 topic hz tool https://vulnogram.org/CVE-2024-42002 https://vulnogram.org/CVE-2024-42002 A code injection vulnerability has been discovered in the Robot Operating System 2 (ROS 2) 'ros2topic' command-line tool, affecting all ROS 2 distributions from Crystal Clemmys up to and including Lyrical Luth and Rolling Ridley. The vulnerability li… High Mon, 28 Sep 2026 21:38:08 GMT CVE-2026-87798 · 5.8 MEDIUM — LXD client recursive file pull allows directory escape via malicious VM agent https://vulnogram.org/CVE-2026-87798 https://vulnogram.org/CVE-2026-87798 Improper link resolution in the recursive file pull feature of the LXD CLI client in Canonical LXD versions 4.0.2 up to 6.9 (fixed in 4.0.14, 5.0.10 and 5.21.8) on Linux allows an attacker with root access inside a virtual machine to write attacker-c… Medium Mon, 28 Sep 2026 13:22:36 GMT CVE-2026-87799 · 9.9 CRITICAL — Arbitrary file write on LXD host via symlink in migration stream https://vulnogram.org/CVE-2026-87799 https://vulnogram.org/CVE-2026-87799 Improper link resolution in the migration receive path in Canonical LXD versions 4.0 and later (fixed in 4.0.14, 5.0.10, 5.21.8 and 6.10) on Linux allows an authenticated client that can create instances or custom storage volumes in a project, or a m… Critical Mon, 28 Sep 2026 13:22:29 GMT CVE-2026-97335 · 7.7 HIGH — Incorrect authorization in LXD storage volume API allows reading volumes from other projects https://vulnogram.org/CVE-2026-97335 https://vulnogram.org/CVE-2026-97335 Incorrect authorization in the custom storage volume creation endpoint in Canonical LXD versions 5.0.0 and later (fixed in 5.0.10, 5.21.8 and 6.10) on Linux allows an authenticated client with permission to create custom volumes in a project to copy,… High Mon, 28 Sep 2026 13:22:19 GMT CVE-2026-85185 · 9.6 CRITICAL — Path traversal in LXD btrfs storage driver allows arbitrary file deletion and write on host as root https://vulnogram.org/CVE-2026-85185 https://vulnogram.org/CVE-2026-85185 Path traversal in the btrfs storage driver in Canonical LXD versions 4.0.2 and later (fixed in 4.0.14, 5.0.10, 5.21.8 and 6.10) on Linux allows an authenticated client with permission to create instances in a project to delete arbitrary files on the… Critical Mon, 28 Sep 2026 13:21:51 GMT CVE-2026-85526 · 9.9 CRITICAL — Path traversal via Btrfs optimized-backup subvolumes[].path enables root file/dir manipulation in LXD https://vulnogram.org/CVE-2026-85526 https://vulnogram.org/CVE-2026-85526 Path traversal in the Btrfs storage driver (unpackVolume) in Canonical LXD on Linux allows an authenticated user with instance creation privileges to delete or replace arbitrary files and directories on the host filesystem as root via a crafted subvo… Critical Mon, 28 Sep 2026 13:21:40 GMT CVE-2026-86335 · 6.3 MEDIUM — LXD Cross-Project Private Image Theft via Unsanitized GetImageFromAnyProject Local Reuse https://vulnogram.org/CVE-2026-86335 https://vulnogram.org/CVE-2026-86335 Missing Authorization in imageDownload in Canonical LXD before 5.0.10, 5.21.8, and 6.10 on Linux allows a project-restricted client to access private images from other projects via local fingerprint reuse during image or instance import requests. Medium Mon, 28 Sep 2026 13:21:29 GMT CVE-2026-86334 · 4.2 MEDIUM 🌩️ — CLI Path Traversal via Content-Disposition in LXD Image Export/Copy https://vulnogram.org/CVE-2026-86334 https://vulnogram.org/CVE-2026-86334 Path traversal in the CLI client image export and copy functionality in Canonical LXD from 4.0.2 before 4.0.14, 5.0.10, 5.21.8, and 6.10 on all platforms allows a remote malicious or machine-in-the-middle image server to overwrite arbitrary local fil… Medium Network Exploitable Mon, 28 Sep 2026 13:21:15 GMT CVE-2026-79619 · 7.3 HIGH — OpenZFS: user-namespace capability check allows unprivileged local authorization bypass https://vulnogram.org/CVE-2026-79619 https://vulnogram.org/CVE-2026-79619 On Linux, several OpenZFS ioctl authorization checks accept a capability held only within a user-created, unprivileged namespace as equivalent to real host privilege, allowing an unprivileged local user to perform operations that should require root.… High Wed, 26 Aug 2026 12:50:10 GMT CVE-2026-66897 · 9.9 CRITICAL — Instance template path traversal allows arbitrary host file write as root https://vulnogram.org/CVE-2026-66897 https://vulnogram.org/CVE-2026-66897 A path traversal vulnerability in LXD's instance template processing allows an attacker with container edit permissions, or any user launching a crafted image, to overwrite arbitrary files on the host system as root. When processing target template p… Critical Mon, 24 Aug 2026 09:08:04 GMT CVE-2026-77113 · 6.7 MEDIUM — Path Traversal Vulnerability in apport-unpack https://vulnogram.org/CVE-2026-77113 https://vulnogram.org/CVE-2026-77113 Path traversal in apport-unpack in Canonical Apport before 2.36.0, 2.34.2, and 2.28.4 on Linux allows an attacker to create or overwrite arbitrary files with the privileges of the executing user via an attacker controlled key names in crash report fi… Medium Thu, 20 Aug 2026 22:32:51 GMT CVE-2026-61898 · 7.8 HIGH — accountsservice: shell injection via attacker-controlled ~/.pam_environment in Ubuntu language helper scripts https://vulnogram.org/CVE-2026-61898 https://vulnogram.org/CVE-2026-61898 The Ubuntu-specific language helper scripts (save-to-pam-env, update-langlist) shipped with accountsservice before 23.13.9-8ubuntu7 treat the user-controlled LANGUAGE entry in ~/.pam_environment as trusted input. The value is interpolated unescaped i… High Thu, 20 Aug 2026 14:32:59 GMT CVE-2026-61897 · 7.8 HIGH — accountsservice: incomplete privilege drop when running Ubuntu-specific language helper scripts https://vulnogram.org/CVE-2026-61897 https://vulnogram.org/CVE-2026-61897 An Ubuntu-specific patch to AccountsService before 23.13.9-8ubuntu7 only partially drops privileges before launching language helper scripts. It changes the effective UID/GID to the target user but leaves the real UID as 0 (root). A shell spawned by… High Thu, 20 Aug 2026 14:32:53 GMT CVE-2026-16033 · 8.5 HIGH — Arbitrary file read+write on host via templates/ symlink in malicious image https://vulnogram.org/CVE-2026-16033 https://vulnogram.org/CVE-2026-16033 A path traversal vulnerability in LXD allows an attacker to achieve arbitrary host file read or unconstrained file creation. When processing image metadata templates, LXD fails to properly sanitize or restrict template file paths from escaping the in… High Wed, 12 Aug 2026 20:11:08 GMT CVE-2026-66898 · 9.9 CRITICAL — Path traversal via unvalidated instance name in backup tarball restore enables root file write / RCE https://vulnogram.org/CVE-2026-66898 https://vulnogram.org/CVE-2026-66898 A path traversal vulnerability in LXD allows an attacker to manipulate file system paths during backup import and restore operations. When importing or restoring a backup archive, LXD fails to validate instance and storage volume names contained with… Critical Wed, 12 Aug 2026 20:07:32 GMT CVE-2026-63293 · 9.9 CRITICAL — Arbitrary File Read/Write: metadata.yaml symlink in image allows host filesystem access as root https://vulnogram.org/CVE-2026-63293 https://vulnogram.org/CVE-2026-63293 A link following vulnerability in LXD allows an attacker to achieve arbitrary file read and write operations on the host system. When importing or unpacking an image archive, LXD fails to validate whether the metadata.yaml file is a symbolic link. An… Critical Wed, 12 Aug 2026 20:00:09 GMT CVE-2026-63294 · 9.9 CRITICAL — Root RCE via image backup.yaml symlink https://vulnogram.org/CVE-2026-63294 https://vulnogram.org/CVE-2026-63294 A link following vulnerability in LXD allows an attacker to achieve root command execution on the host system. During the import or unpacking of crafted image or backup archives, LXD fails to properly validate and confine the backup.yaml file when it… Critical Wed, 12 Aug 2026 19:57:07 GMT CVE-2026-63295 · 4.3 MEDIUM — Project restriction `restricted.containers.privilege=isolated` bypassable by omitting `security.idmap.isolated` https://vulnogram.org/CVE-2026-63295 https://vulnogram.org/CVE-2026-63295 An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass project-level container isolation restrictions. When a project is configured with restrictions on container privileges (such as enforcing restricted.containers.pr… Medium Wed, 12 Aug 2026 19:31:32 GMT CVE-2026-63296 · 9.9 CRITICAL — Project restriction bypass via instance migration config override https://vulnogram.org/CVE-2026-63296 https://vulnogram.org/CVE-2026-63296 An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project restrictions during instance migration. When migrating an instance to a target project, LXD accepts configuration overrides without validating the… Critical Wed, 12 Aug 2026 19:27:45 GMT CVE-2026-63297 · 9.9 CRITICAL — Cross-project instance copy bypasses target project restrictions via TOCTOU in config merge https://vulnogram.org/CVE-2026-63297 https://vulnogram.org/CVE-2026-63297 An authorization bypass vulnerability in LXD due to a timing flaw during configuration merging allows an authenticated attacker to bypass target project restrictions during cross-project instance copies. When copying an instance to a target project,… Critical Wed, 12 Aug 2026 19:25:24 GMT CVE-2026-63298 · 8.7 HIGH — LXD arbitrary lxc.conf directive injection via NVIDIA instance configuration https://vulnogram.org/CVE-2026-63298 https://vulnogram.org/CVE-2026-63298 An improper neutralization of special elements vulnerability in LXD's NVIDIA instance configuration handling allows an authenticated attacker to inject arbitrary configuration directives. By supplying newline characters within the 'nvidia.driver.capa… High Wed, 12 Aug 2026 19:22:07 GMT CVE-2026-63299 · 8.5 HIGH — Storage volume cross-project move and snapshot restore bypass project disk limits https://vulnogram.org/CVE-2026-63299 https://vulnogram.org/CVE-2026-63299 An authorization bypass vulnerability in LXD allows an authenticated user to bypass project-level disk and volume limits. Two related code paths fail to verify resource limits during volume operations: the storagePoolVolumeTypePostMove function omits… High Wed, 12 Aug 2026 19:17:07 GMT CVE-2026-62420 · 9.9 CRITICAL — Cross-project cluster migration bypasses project restrictions via cluster notification flag https://vulnogram.org/CVE-2026-62420 https://vulnogram.org/CVE-2026-62420 An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project security restrictions during cross-project instance migrations. When moving an instance cross-project to a different cluster member via POST /1.0/i… Critical Wed, 12 Aug 2026 19:12:28 GMT CVE-2026-63300 · 9.9 CRITICAL — Cross-project instance move bypasses all project restrictions allowing host command execution https://vulnogram.org/CVE-2026-63300 https://vulnogram.org/CVE-2026-63300 An improper validation vulnerability in the instancePostMigration function in lxd/instance_post.go of LXD allows an authenticated attacker with can_create_instances permissions on a restricted project to bypass project-level security restrictions. Wh… Critical Wed, 12 Aug 2026 19:09:04 GMT CVE-2026-8933 · 7.8 HIGH — snap-confine Local Privilege Escalation via Capabilities Misconfiguration or Flaw in Execution Environment Setup https://vulnogram.org/CVE-2026-8933 https://vulnogram.org/CVE-2026-8933 A local privilege escalation vulnerability exists in snap-confine, a set-capabilities core component used internally by Canonical snapd to construct the secure execution environment for snap applications. This vulnerability uniquely affects versions… High Tue, 21 Jul 2026 14:02:19 GMT CVE-2026-15226 · 8.4 HIGH — snapd snap-confine Sandbox Confinement Bypass via Omission of setuid Restriction in Seccomp Templates https://vulnogram.org/CVE-2026-15226 https://vulnogram.org/CVE-2026-15226 A sandbox confinement bypass vulnerability exists in Canonical snapd within its internal execution environment compiler (snap-confine). The default seccomp security templates generated by the engine to restrict system calls do not filter or reject pr… High Tue, 21 Jul 2026 14:02:04 GMT CVE-2024-5300 · 5.6 MEDIUM — AppArmor Base Profile Misconfiguration in snapd Permits Confined Snaps Unauthorized Access to Hashed Passwords via systemd-userdbd https://vulnogram.org/CVE-2024-5300 https://vulnogram.org/CVE-2024-5300 An access control bypass and information disclosure vulnerability exists in the base AppArmor security profile configuration of Canonical snapd. The abstraction rules located in /etc/apparmor.d/abstractions/nss-systemd (inherited via ) inadvertently… Medium Tue, 21 Jul 2026 14:00:51 GMT CVE-2026-12391 · 5 MEDIUM — ubuntu-pro-client Local Privilege Escalation and Information Disclosure via Symlink Arbitrary File Read in collect-logs https://vulnogram.org/CVE-2026-12391 https://vulnogram.org/CVE-2026-12391 An insecure symlink following vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools) within the pro collect-logs command framework. The utility creates or utilizes predictable temporary file paths or user-accessible log… Medium Thu, 16 Jul 2026 12:17:01 GMT CVE-2026-11386 · 9 CRITICAL 🌩️ — ubuntu-pro-client Input Validation Vulnerability Leading to Arbitrary APT Directive Injection and Remote Code Execution https://vulnogram.org/CVE-2026-11386 https://vulnogram.org/CVE-2026-11386 An input validation and injection vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools). The client constructs APT source files (such as /etc/apt/sources.list.d/ubuntu-.list or their DEB822 equivalents) using data rece… Critical Network Exploitable Thu, 16 Jul 2026 12:16:02 GMT CVE-2026-9494 · 5.5 MEDIUM — ubuntu-pro-client Information Disclosure via Cleartext Bearer Token Exposure in Process Command Line https://vulnogram.org/CVE-2026-9494 https://vulnogram.org/CVE-2026-9494 An information disclosure vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools). The client validates Ubuntu Pro APT credentials by executing /usr/lib/apt/apt-helper using the download-file command. During this process… Medium Thu, 16 Jul 2026 12:12:27 GMT CVE-2026-10037 · 8.8 HIGH — Sandbox Escape in Ubuntu OpenJDK Packages via xdg-desktop-portal https://vulnogram.org/CVE-2026-10037 https://vulnogram.org/CVE-2026-10037 A sandbox escape vulnerability exists in the OpenJDK packages provided in Ubuntu. The .jar MIME handlers installed by these packages execute files marked as executable when the mailcap package is installed. A compromised or malicious sandboxed applic… High Wed, 08 Jul 2026 21:18:56 GMT CVE-2026-28385 · 5 MEDIUM — SSRF via image import from URL allows internal network probing by authenticated users https://vulnogram.org/CVE-2026-28385 https://vulnogram.org/CVE-2026-28385 In Canonical LXD versions 4.12 through 6.9, a Server-Side Request Forgery (SSRF) vulnerability in the image import functionality allows authenticated users with the can_create_images entitlement to interact with internal network infrastructure via th… Medium Fri, 26 Jun 2026 16:23:56 GMT CVE-2026-9640 · 7.2 HIGH — LXD Snapshot Import Privilege Escalation Vulnerability https://vulnogram.org/CVE-2026-9640 https://vulnogram.org/CVE-2026-9640 A privilege escalation vulnerability exists in LXD from 6.0 before 6.9, 5.21.0 before 5.21.5, and 5.0.0 before 5.0.7 regarding the handling of project-restriction policies during snapshot restoration.. An authenticated project operator in a restricte… High Fri, 26 Jun 2026 15:50:38 GMT CVE-2026-9639 · 6.5 MEDIUM — Authenticated Denial of Service via Malicious Backup Tarball in LXD https://vulnogram.org/CVE-2026-9639 https://vulnogram.org/CVE-2026-9639 Nil-pointer dereference in CreateCustomVolumeFromBackup in LXD up to version 6.8 and 5.21 on Linux allows an authenticated user with can_create_storage_volumes permissions to cause a denial of service via a specially crafted custom-volume backup tarb… Medium Fri, 26 Jun 2026 15:39:04 GMT CVE-2026-12411 · 8.4 HIGH — Broken Access Control in Canonical LXD DevLXD API https://vulnogram.org/CVE-2026-12411 https://vulnogram.org/CVE-2026-12411 Broken Access Control in the devLXDInstancePatchHandler component of Canonical LXD allows an untrusted guest to mount, read, and overwrite another guest's custom storage volume via a crafted device PATCH request over /dev/lxd when security.devlxd.man… High Fri, 26 Jun 2026 15:27:55 GMT CVE-2026-12249 · 9 CRITICAL 🌩️ — Canonical ADSys Trust Store Poisoning via Plaintext HTTP Certificate Auto-Enrollment https://vulnogram.org/CVE-2026-12249 https://vulnogram.org/CVE-2026-12249 An issue was discovered in Canonical ADSys upstream versions through v0.16.2. During Active Directory Certificate Services (AD CS) certificate auto-enrollment via the vendored Samba client script (internal/policies/certificate/python/vendor_samba/gp/… Critical Network Exploitable Mon, 22 Jun 2026 15:43:33 GMT CVE-2026-6653 · 7 HIGH 🌩️ — libxml2: Use after free in xmlParseInternalSubset via improper entity resolution handling https://vulnogram.org/CVE-2026-6653 https://vulnogram.org/CVE-2026-6653 Use After Free in libxml2's xmlParseInternalSubset from GNOME libxml2 version 2.9.11 to 2.11.0 allows a remote attacker to cause a denial-of-service via maliciously crafted XML input with improper entity resolution handling. High Network Exploitable Mon, 22 Jun 2026 12:40:31 GMT CVE-2026-10720 · 5.1 MEDIUM — MicroCeph path traversal issue in the remote-import API https://vulnogram.org/CVE-2026-10720 https://vulnogram.org/CVE-2026-10720 Canonical MicroCeph versions from the squid and tentacle track are vulnerable to a path traversal issue in the remote-import API. Holders of a trusted cluster mTLS certificate (such as enrolled cluster members) or join token can manipulate files in a… Medium Fri, 19 Jun 2026 04:57:48 GMT CVE-2026-47337 · 3.3 LOW — NULL pointer dereference in Ubuntu Linux AppArmor IPv4/IPv6 socket mediation https://vulnogram.org/CVE-2026-47337 https://vulnogram.org/CVE-2026-47337 Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches with a possible NULL pointer dereference in the handling of AF_INET/AF_INET6 socket mediation. The bug can be triggered by an unprivileged local user. This can lead to a kernel oops. Low Thu, 28 May 2026 18:29:20 GMT CVE-2026-47336 · 3.3 LOW — Use of uninitialized value in Ubuntu Linux AppArmor IPv4/IPv6 socket mediation rules https://vulnogram.org/CVE-2026-47336 https://vulnogram.org/CVE-2026-47336 Ubuntu Linux 6.8 contains SAUCE patches with a possible use of an uninitialized variable in AppArmor AF_INET/AF_INET6 socket mediation code. The bug can be triggered by an unprivileged local user and could result in incorrect fine-grained mediation o… Low Thu, 28 May 2026 18:29:01 GMT CVE-2026-47335 · 5.5 MEDIUM — NULL pointer dereference in Ubuntu Linux AppArmor notification handling https://vulnogram.org/CVE-2026-47335 https://vulnogram.org/CVE-2026-47335 Ubuntu Linux 6.8 contains SAUCE patches with a possible NULL pointer dereference in the handling of AppArmor notifications. The bug can be triggered by an unprivileged local user. This can lead to a kernel panic. Medium Thu, 28 May 2026 18:28:49 GMT CVE-2026-47334 · 5.5 MEDIUM — Deadlock or kernel panic in Ubuntu Linux AppArmor notification handling https://vulnogram.org/CVE-2026-47334 https://vulnogram.org/CVE-2026-47334 Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which incorrectly sleep while holding a spinlock in notification handling code. The bug can be triggered by an unprivileged local user and can result in kernel panic or deadlock. Medium Thu, 28 May 2026 18:28:39 GMT CVE-2026-47333 · 7.8 HIGH — Out-of-bounds read in Ubuntu Linux AppArmor notification handling https://vulnogram.org/CVE-2026-47333 https://vulnogram.org/CVE-2026-47333 Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which can potentially incorrectly compute the size of an internal buffer, leading to a heap memory out-of-bounds read in notification handling code. The bug can be triggered by an unprivil… High Thu, 28 May 2026 18:28:28 GMT CVE-2026-47332 · 5.5 MEDIUM — Out-of-bounds read in Ubuntu Linux AppArmor notification handling https://vulnogram.org/CVE-2026-47332 https://vulnogram.org/CVE-2026-47332 Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which incorrectly validate the size of an internal structure, leading to an out-of-bounds read in notification handling code. The bug can be triggered by an unprivileged local user and can… Medium Thu, 28 May 2026 18:28:18 GMT CVE-2026-47331 · 7.8 HIGH — Use-after-free in Ubuntu Linux AppArmor notification handling https://vulnogram.org/CVE-2026-47331 https://vulnogram.org/CVE-2026-47331 Ubuntu Linux 6.8 contains AppArmor SAUCE patches which fail to acquire a lock when modifying a linked list. An unprivileged local user could trigger the race condition that can lead to a use-after-free (UAF) and, theoretically, arbitrary code executi… High Thu, 28 May 2026 18:28:08 GMT