The vulnerability arises when AppArmor receives DFA tables that are not 8‑byte aligned. During unpacking the kernel performs unaligned memory accesses on architectures that require alignment, triggering kernel warnings and potentially a crash. This constitutes a type‑confusion flaw corresponding to CWE‑843, where the kernel misinterprets data types, leading to memory corruption. The resulting kernel instability can cause denial of service. Based on the stack trace, the flaw is triggered by unaligned DFA data supplied by an AppArmor profile update.

All Linux kernel builds that include the AppArmor subsystem before the alignment fix was applied. The issue appears in kernel revisions such as 6.18.0‑rc6+ but is present in any unpatched kernel that ships AppArmor. Distributions that provide the default Linux kernel with AppArmor before the fix are affected.

The CVSS score is 5.5, indicating moderate severity, and the EPSS score is less than 1%, showing a low likelihood of public exploitation. The vulnerability is not listed in CISA KEV. The kernel crash can result in denial of service. The likely attack vector is manipulation of AppArmor profile updates that supply an unaligned DFA table; remote exploitation would require an attacker to inject data into the user‑space side that ultimately reaches the kernel. No public exploits are known, and the impact warrants prompt remediation.