During a reference count update for the AppArmor socket context, the function unduly increments the reference of the plabel object while still freeing it in the caller, causing a reference count leak. The leak can accumulate over time, eventually exhausting kernel memory or corrupting internal structures, which may lead to a kernel crash or degraded system stability. Because the flaw resides in low‑level kernel networking code, it potentially affects any kernel instance where AppArmor is active and sockets are managed.

All Linux kernel implementations that include the AppArmor loadable module are affected until the patch that resolves the refcount leak is applied. The weakness involves improper resource release, so it applies broadly across kernel releases prior to the inclusion of the fix commit.

The risk of exploitation is limited by the requirement to trigger the faulty update path, which is not publicly documented as an attack vector. The EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog, indicating a low probability of widespread exploitation. The CVSS score of 7.8 indicates high severity. Nevertheless, a local or privileged attacker that can inject traffic or otherwise manipulate socket contexts could potentially accelerate the refcount leak, leading to resource exhaustion or a denial‑of‑service scenario.