The flaw is caused by an incorrect use of container_of on a file pointer in the IMA appraise measurement function, resulting in a stack-out-of-bounds read during is_bprm_creds_for_exec(). This out-of-bounds access can expose data stored on the kernel stack or lead to a crash when privileged code processes a binary measurement.

All Linux kernel releases that contain the IMA appraiser framework before the commit inserting the bprm_is_check boolean are affected. The vulnerability applies to every distribution running an unpatched kernel that has the IMA module enabled.

Based on the description, it is inferred that the likely attack vector is a local attacker who can execute privileged code that triggers IMA measurement, such as via sudo or privileged binary execution. The bug is a local kernel read flaw; the EPSS score is below 1% and the flaw is not listed in the CISA KEV catalog, indicating a low to medium exploitation probability. The impact is limited to information disclosure or potential kernel instability for privileged users, with no direct remote code execution pathway reported.