The vulnerability is a null pointer dereference in the AppArmor subsystem of the Linux kernel. When export_binary is disabled, previously loaded profiles keep a rawdata entry in AppArmorFS pointing to a symbolic link. If such a profile is later replaced, the rawdata pointer is cleared to NULL, yet the kernel still attempts to read profile->rawdata->name while resolving that symbolic link, causing a kernel oops and a system crash.

Affected systems are all Linux kernels with AppArmor enabled that use the pre‑fix logic. This includes any distribution kernel version that contains the rawdata dereference flaw before the commit that introduced the fix, such as kernel 6.19.0-rc7 and earlier. The CPE string cpe:2.3:o:linux:linux_kernel:* indicates an impact on the Linux kernel as a whole.

The CVSS score of 5.5 indicates moderate severity. The EPSS score of less than 1% suggests a very low probability of exploitation. The flaw is not included in the CISA KEV list. Exploitation requires the ability to manipulate AppArmor profiles and the export_binary setting, which typically requires local or elevated privileges—this is inferred because the attack path involves profile replacement and kernel parameter adjustment. An attacker who can execute those actions can trigger a kernel crash, resulting in a denial‑of‑service condition, but the vulnerability does not grant arbitrary code execution.