The defect is a side‑effect bug within the AppArmor DFA matching code. When the match_char() macro is used with *str++, the string pointer is incremented on each inner loop iteration, causing the algorithm to skip characters and eventually read past the end of the input buffer. This out‑of‑bounds read can expose kernel memory contents or trigger a crash. The weakness is identified as CWE‑788, indicating an improper handling of buffer boundaries.

All Linux kernel builds that enable AppArmor are affected until the patch is applied. The specific commit introducing the fix is included in the 6.19.0‑rc7-next‑20260127 series and later upstream releases. No specific affected version list is provided, so any kernel version containing AppArmor prior to that commit is vulnerable.

The CVSS base score of 7.8 classifies the flaw as high severity. The EPSS score is below 1 %, indicating a low current exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation would most likely occur from local context where AppArmor policy evaluation is triggered, such as during a file open, but no remote trigger is documented. The attack vector is inferred from the stack trace showing a file open leading to aa_dfa_match.