The root cause is a race condition in the Linux kernel’s AppArmor subsystem that occurs when a Unix domain socket’s peer_path is accessed outside of the socket’s state lock. The bug allows a reference to the peer socket’s path to exist while the socket may concurrently be released by unix_release_sock(), which can result in a use‑after‑free or leakage of the path string. Based on the description, it is inferred that this race could expose privileged file locations or enable memory corruption, potentially leading to information disclosure or privilege escalation in a kernel context.

The flaw is present in every Linux kernel version released before the patch that adds the state‑lock guard for peer_path. Because the affected product is listed as Linux:Linux with no version specifics, any Linux distribution that has not applied the commit that implements this fix is potentially exposed.

The CVSS score of 8.8 indicates high severity. The EPSS score of < 1% indicates a very low probability of exploitation, and the vulnerability is not listed in CISA KEV. The likely attack vector is a local user manipulating Unix domain sockets to trigger the race condition. If an attacker can control a socket’s peer_path, they may observe sensitive path information or cause a kernel memory corruption that could lead to privilege escalation. The risk is therefore considered medium to high, with the severity increasing if the exposed paths point to privileged assets.