The Linux kernel AppArmor subsystem contains a flaw where the function aa_replace_profiles accesses the field udata->size after releasing the reference via aa_put_loaddata, creating a use‑after‑free condition. This bug could lead to unpredictable kernel memory corruption or other unstable behavior if it is triggered. The vulnerability was resolved by storing the size value locally before dropping the reference.

Linux kernel versions that include the buggy implementation of aa_replace_profiles are affected. All distributions running a kernel build prior to the patch that saves the size before discarding the reference are vulnerable. No vendor‑specific version list is provided, but the flaw applies to the AppArmor component across supporting releases that have not yet incorporated the fix.

The CVSS score is 7.8, and the EPSS score is < 1%. The CISA KEV catalog lists no entry for this vulnerability. The presence of a use‑after‑free in kernel space indicates high potential severity for anyone able to trigger the affected code path. No public exploits or detailed attack methods are reported in the available references, and the exact attack vector is not specified beyond the bug description.