An attacker with ordinary local privileges can manipulate AppArmor by opening the apparmor filesystem interfaces and passing the resulting file descriptor to a privileged process. Through this confused‑deputy technique the privileged process performs writes that load, replace, or delete policies. Such unauthorized policy changes can remove confinement, deny execution of applications (DoS), bypass user‑namespace restrictions, or act as a foothold for further kernel‑level privilege escalation. The weakness is a failure of access control over the policy management interface.

All Linux kernel versions that include AppArmor and have not yet applied the commit enforcing stricter access checks are affected. The issue is present in any distribution shipping the unpatched kernel, regardless of vendor. Specific kernel release numbers are not listed, so all unmodified kernels with AppArmor enabled should be considered vulnerable.

The CVSS v3 score of 7.8 indicates high severity, yet the EPSS probability is below 1%, implying a low chance of widespread exploitation. The vulnerability is not part of the CISA Known Exploited Vulnerabilities catalog. Exploitation requires a local user to coerce a privileged process into performing the write; once this is achieved, the attacker gains full control of policy management and can compromise the system.