A use-after-free vulnerability in the Linux kernel AppArmor subsystem could allow a local attacker to execute arbitrary code or cause a system crash.

This is a use-after-free vulnerability caused by a race condition in the AppArmor rawdata dereference process. An attacker with local access can trigger the flaw during profile removal, leading to the access of freed memory.

Successful exploitation of this vulnerability could lead to a full compromise of the affected system. Because the flaw occurs within the kernel context, an attacker can gain elevated privileges, bypass security restrictions, or cause a denial of service through system instability. Given the CVSS score of 7.8, this represents a high-severity risk for any environment relying on Linux kernel security modules.

Immediate Action: Update the Linux kernel to version 5.10.253, 5.15.203, 6.1.169, 6.6.130, or a later stable release provided by your distribution vendor.

Proactive Monitoring: Monitor system logs for kernel oops or segmentation faults that may indicate an attempted exploitation of the AppArmor subsystem.

Compensating Controls: Restrict local access to the system to only trusted users, as the vulnerability requires local access to trigger the race condition.

Public Exploit Available: Unknown

The vulnerability presents a significant risk to the integrity and availability of Linux-based systems. Administrators should prioritize the deployment of kernel updates provided by their respective Linux distribution maintainers. If an immediate reboot is not feasible, restrict local access to the affected hosts to mitigate the risk of an attacker triggering this race condition.