The vulnerability in the Linux kernel's AppArmor component allows a NULL pointer dereference while parsing a PDB file. When the unpack_dfa helper fails, the pdb->dfa member remains NULL and subsequent code dereferences it, causing a kernel panic. This leads to a denial‑of‑service condition for the affected system with no direct confidentiality or integrity impact. The weakness is a classic NULL pointer dereference (CWE‑476).

All Linux systems running a kernel version prior to the commit that fixed the issue are affected, regardless of distribution, as AppArmor is part of the mainline kernel. The patch is included in the mainline source, affecting any kernel compiled from that source before the fix. No specific version ranges are listed, but the vulnerability applies to every affected kernel build that has AppArmor enabled.

The CVSS score is not provided, but a kernel crash is a critical availability flaw, indicating high risk. EPSS data is unavailable, so exploitation likelihood is unclear. The vulnerability is not listed in the CISA KEV catalog. The typical attack vector appears to be local, requiring an attacker to supply a malformed AppArmor profile or trigger the unpack_pdb function, though no evidence of a remote exploit is presented.