The flaw resides in the Linux kernel’s AppArmor subsystem, where POSIX CPU timer limits are not correctly applied. As a result, a process can bypass the resource limits intended to throttle CPU usage, potentially leading to resource exhaustion or denial of service. This issue is a classic example of CWE‑770: Resource Leak via inadequate cleanup, where resource limits are not properly enforced by the operating system.

All Linux kernel builds that contain the incorrect rlimit handling for POSIX CPU timers before the commit that introduces this fix are affected. Vendor information indicates Linux as the affected platform, but specific kernel version ranges are not listed in the available data, so administrators should assess whether their running kernel includes this bug.

The CVSS score is not provided, and the EPSS score is unavailable, leaving the exact severity uncertain. Based on the description, it is inferred that the vulnerability requires local access to the system to trigger, as it is a kernel‑level resource limit enforcement flaw. A local attacker, particularly one with kernel or elevated privileges, could exploit the flaw to increase CPU usage beyond intended limits, potentially denying service to other users or processes. The lack of a public exploit and its presence in the kernel suggest a moderate to high risk if the affected kernel is in use, though precise impact depends on system configuration and workload patterns. The vulnerability is not listed in the CISA KEV catalog.