After talking it over with Kees Cook, I think it's best to handle this bug as a security update and go through the Ubuntu Security Team rather than SRU.
After talking it over with Kees Cook, I think it's best to handle this bug as a security update and go through the Ubuntu Security Team rather than SRU.