An uninitialized pointer inside the AppArmor subsystem was able to propagate to the audit logging function, resulting in an attempt to read memory that had not been mapped. The kernel then triggered a page fault that caused an Oops and crash of the operating system. Because the flaw is triggered during normal file operations involving AppArmor audit logs, a local attacker or any user able to open a specific file could force the kernel to crash, disrupting availability. The vulnerability does not provide an escalation path or remote code execution. Its primary impact is a denial of service that can be activated by in‑application or system file access patterns.

The issue exists in all Linux kernel releases that contain the AppArmor module prior to the patch commit that moved the null‑file check. It can affect any distribution that ships the affected kernel, such as openSUSE 7.0.2, and is applicable to all platforms where AppArmor is enabled. The bug will be fixed in any kernel that includes commit 4a134723f9f1 and later.

Because the CVSS score is not provided and EPSS is unavailable, the precise risk level cannot be quantified, however the failure causes a critical kernel crash. The vulnerability is not listed in the CISA KEV catalogue, suggesting no known active exploitation. The most likely exploit path requires local access to trigger a file open that passes an uninitialized string to the audit logger. Without such privileges the flaw remains largely contained to a local user context and cannot be leveraged for remote or privilege‑escalation attacks.