The AppArmor subsystem’s verify_dfa() routine performs a bounds check on its DEFAULT table only when a state is not differentially encoded. When the verification loop follows a differential encoding chain, it reads an element from DEFAULT_TABLE and uses it as an array index without validation. If a crafted DFA contains a DEFAULT_TABLE entry that is greater than or equal to the total state count, the routine will index outside the bounds of the intended array. This results in out-of-bounds reads and writes that can corrupt kernel memory. Such corruption can compromise the confidentiality, integrity, or availability of the kernel, and may allow an attacker with sufficient privileges to gain elevated privileges or crash the system.

All Linux kernel installations that include the AppArmor module before the remediation are affected. The vulnerability was observed in kernel 6.19.0-rc7-next-20260127 and inherently applies to all releases that have not yet incorporated the 5a68e46dfe0c8c8ffc6f425ebc4cae6238566ecc commit. Users running any Linux distribution with a kernel older than the patched release are at risk.

The CVSS score of 7.8 indicates a high severity. EPSS is below 1 %, so current exploitation probability is low, and CISA has not listed it as a known exploited vulnerability. However, the exploit requires the ability to supply a malformed DFA to the AppArmor verifier, which is typically achievable only by local users who can write or replace policy files, or by attackers who can deliver a malicious kernel image. If successful, the kernel memory corruption could be exploited to elevate privileges or cause a denial of service. Therefore, the risk increases for environments where AppArmor policies are modifiable by untrusted users or where kernel updates are delayed.