In the Linux kernel, the apparmor function aa_get_buffer() reduces a per‑CPU hold counter without checking for underflow. When the counter reaches zero while a buffer is still counted, the unsigned decrement wraps to a very large value, preventing the buffer from returning to the global list. This can cause other CPUs to starve for buffers, forcing repeated kmalloc(aa_g_path_max) allocations and exhausting memory. The weakness is an integer underflow (CWE‑191) that manifests as a denial‑of‑service condition caused by memory exhaustion.

The vulnerability resides in the Linux kernel’s apparmor subsystem. Version information is not provided in the advisory; therefore, the exact kernel releases affected cannot be specified. The patch appears to be applied uniformly across kernel versions that incorporate the fix, but users should refer to their distribution’s security advisories to determine if their installed kernel includes the correction.

The flaw is local to the system. Based on the description, it is inferred that exploitation requires the ability to execute code that invokes aa_get_buffer(), which normally occurs during kernel operations for any user process interacting with AppArmor profiles. The EPSS score is < 1% and the vulnerability is not listed in CISA’s KEV catalog, indicating limited public exploitation data. Nonetheless, the risk is significant in environments that rely heavily on AppArmor and may experience immediate denial of service through memory exhaustion once counters underflow.