A race condition in the AppArmor module causes the reference count of a rawdata list entry to be increased from zero, leading to a use‑after‑free when the kernel later drops the reference on that entry. This occurs in the rawdata dedup loop of aa_replace_profiles(), where an unguarded kref_get() increments a counter on an already‑freed object. The resulting memory corruption is visible through hardened counter warnings and can trigger kernel crashes or data corruption. Based on the description, it is inferred that an attacker could trigger the dedup loop by feeding crafted policy blobs into AppArmor, potentially causing the file descriptor or memory corruption.

All Linux kernel builds that include AppArmor and have not yet applied the patch commit that introduces aa_get_profile_loaddata_not0(). The provided CPE identifier covers the generic Linux kernel, so every distribution running a kernel prior to the fix is affected. No specific vendor or version ranges are listed in the CNA data, but any kernel that compiled with AppArmor support is vulnerable.

The CVSS score of 7.8 indicates moderate‑to‑high severity, while the EPSS score of less than 1% suggests a very low likelihood of real‑world exploitation at the time of this analysis. The vulnerability is not listed in CISA KEV, implying that no confirmed exploit is known. The attack would require local or privileged access to inject or manipulate AppArmor policy blobs, making it a local‑to‑privilege‑escalation risk rather than a remote attack vector. If exploited, the kernel could crash or experience corruption, potentially allowing privilege escalation in a compromise scenario.