In the Linux kernel's AppArmor subsystem, a flaw in aa_change_profile allows an invalid label reference to be supplied to aa_label_is_unconfined_subset when a prior label build fails. The code path does not verify that the result is NULL or an error pointer before dereferencing it, leading to a kernel panic. The impact is purely a denial of service, as the system crashes without granting code execution or privilege escalation.

The vulnerability exists in all Linux kernel builds that include the AppArmor profile management module. Because no specific kernel version range is listed, the flaw may exist across a broad spectrum of kernel releases until an update that contains the patch is applied.

There is no EPSS or CVSS score provided, but the severity of a kernel panic is high. The flaw requires an attacker to trigger aa_change_profile with an invalid label build, a scenario most likely achievable with local privileges or by manipulating AppArmor profiles. It is not currently listed in the CISA KEV catalog, so active exploitation in the wild has not been documented. Nevertheless, the potential for system-wide downtime makes it a critical issue that should be addressed as soon as possible.