The AppArmor subsystem in the Linux kernel reads start‑state values from policy files that may be supplied by untrusted sources. During the unpacking of a policy the kernel interprets these values as indices into its deterministic finite automaton (DFA) tables. If a start state exceeds the number of entries in the DFA table, the kernel performs an out‑of‑bounds read of kernel memory. This read can expose privileged information and may serve as a foothold for further exploitation, such as privilege escalation.

The flaw resides in the core Linux kernel and therefore affects any Linux distribution that includes the AppArmor module as part of its kernel. No specific kernel release range is listed by the CNA; the patch that resolves the issue was committed in March 2026 and is incorporated into all kernel releases that contain that commit.

The CVSS v3 score of 7.1 classifies this issue as high severity. The EPSS score is below 1 %, indicating that exploitation is unlikely to be widespread, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to craft an AppArmor policy containing an out‑of‑bounds start state and to trigger its loading by the system. The resulting read can expose kernel data, and with additional steps could lead to privilege escalation.