aa_label_alloc precedes the creation of a label proxy by allocating a security identifier (secid). If the subsequent proxy allocation fails, the error path frees only the memory associated with the label while leaving the secid and other initialized resources unresolved. This causes a kernel‑level resource leak that can grow with repeated failures, potentially exhausting kernel resources and destabilizing the system.

The flaw exists in all Linux kernel versions that use the AppArmor subsystem and that have not yet incorporated the fix joined to mainline. Distribution kernels that have not received the corresponding update, regardless of distro, are at risk.

The CVSS score is 7.8, and the EPSS score is < 1%, indicating a very low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. To exploit the issue an attacker must trigger aa_label_alloc failures, which implies executing code in kernel context and therefore typically requires privileged access; this is an inference drawn from the kernel‑level nature of the code. If repeated failures are induced, the resource leak could culminate in a kernel crash or denial of service. No public exploit has been reported, but the combination of a kernel‑level leak and lack of publicly documented mitigation suggests that proactive patching is prudent.