During a reference count update for the AppArmor socket context, the function unduly increments the reference of the plabel object while still freeing it in the caller, causing a reference count leak. The leak can accumulate over time, eventually exhausting kernel memory or corrupting internal structures, which may lead to a kernel crash or degraded system stability. Because the flaw resides in low‑level kernel networking code, it potentially affects any kernel instance where AppArmor is active and sockets are managed.

All Linux kernel implementations that include the AppArmor loadable module are affected until the patch resolving the refcount leak is applied. Since the CWEs associated with this weakness involve improper resource release, it applies broadly across kernel releases prior to the inclusion of the fix commit.

The risk of exploitation is limited by the requirement to trigger the faulty update path, which is not publicly documented as an attack vector. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, indicating a low probability of widespread exploitation. Nevertheless, a local or privileged attacker that can inject traffic or otherwise manipulate socket contexts could potentially accelerate the refcount leak, leading to resource exhaustion or a denial‑of‑service scenario.