In the Linux kernel, a race condition in the AppArmor module allows a use‑after‑free when a user opens a rawdata file while simultaneously removing its corresponding profile. The rawdata inode is not reference‑counted, so the kernel can free the associated aa_loaddata structure after the profile is deleted. When seq_rawdata_open later dereferences the i_private pointer, it accesses freed memory, potentially corrupting data or allowing arbitrary code execution. This vulnerability satisfies CWE‑911, indicating a data‑structure misuse that may compromise confidentiality, integrity, or availability.

The affected components are the Linux kernel implementations of AppArmor rawdata inodes. All distributions that ship the original Linux kernel AppArmor code are potentially impacted. No specific kernel revisions are enumerated in the advisory, so any kernel containing the unpatched rawdata handling code is at risk.

The CVSS base score of 7.8 indicates a high severity vulnerability. The EPSS score is below 1 %, suggesting that exploitation is unlikely in the wild, and the vulnerability is not listed in the CISA KEV catalog. Attackers would need local access with the ability to both open a rawdata file and delete its AppArmor profile, such as a privileged user or a compromised process. The race can be triggered by concurrent operations, so the attack vector is likely local. The impact could be significant if the attacker can cause the kernel to dereference invalid memory, leading to potential crashes or privilege escalation.