A memory corruption vulnerability in the Linux kernel AppArmor subsystem allows local authenticated attackers to achieve arbitrary memory access, posing a severe risk to system integrity.

This is an out-of-bounds read and write vulnerability occurring within the AppArmor verify_dfa function. The flaw arises because the kernel fails to validate array indices during differential encoding chain traversal, allowing a low-privileged local user to trigger memory corruption.

The vulnerability carries a CVSS score of 7.8, reflecting its potential for significant impact on system security. Successful exploitation allows an authenticated local attacker to read or modify kernel memory, which can be leveraged to escalate privileges to root or cause a kernel panic, resulting in unauthorized system control and service disruption.

Immediate Action: Update the Linux kernel to version 5.10.253, 5.15.203, 6.1.169, 6.6.130, or the latest stable release provided by your distribution vendor.

Proactive Monitoring: Monitor system logs for kernel-related faults, particularly those referencing KASAN reports, slab-out-of-bounds errors, or unexpected process crashes involving the AppArmor subsystem.

Compensating Controls: Restrict access to the system to authorized users only and implement strict kernel hardening policies, such as limiting the ability of unprivileged users to load or interact with LSM modules like AppArmor.

Public Exploit Available: Unknown.

Given the severity of potential kernel-level compromise, organizations should prioritize patching their Linux kernel environments. Administrators must identify systems running affected kernel versions and schedule maintenance windows to apply the necessary security updates to prevent local privilege escalation.