The Linux kernel’s AppArmor subsystem contains a flaw in the verification of differential encoding chains. The bug allows a verifier to mistakenly treat a looped chain as already checked, leading to endless iterations during policy parsing. An attacker who can influence the chain used in an apparmor policy update can cause the kernel to consume excessive CPU and memory resources or even stall, resulting in denial of service. The weakness is defined by CWE‑372 and CWE‑835.

Linux kernel releases 4.17 and all 7.0 release candidates (rc1 through rc7) are affected. The AppArmor module is present in these kernels. Information about older releases is not provided in the data, so no definitive statement can be made about them.

The CVSS score of 5.5 indicates moderate severity. The EPSS score of less than 1 % suggests a very low likelihood of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog, and no public exploits have been reported. Based on the description, the likely attack vector involves an actor who can modify AppArmor policy files or otherwise influence the differential encoding chain; specific prerequisites for such an attack are not detailed in the data and are therefore inferred.