A use-after-free vulnerability in the Linux kernel AppArmor component may allow a local attacker to execute arbitrary code or cause system instability.

This vulnerability is a use-after-free (UAF) flaw within the aa_replace_profiles function. The function incorrectly accesses a data structure size after the reference to that data has been released, which can be triggered by a local authenticated user.

The flaw carries a CVSS score of 7.8, reflecting its high severity due to the potential for local privilege escalation and system compromise. Successful exploitation could allow a malicious actor with low-level local access to gain elevated privileges, leading to unauthorized data access, system-wide control, or denial of service through kernel crashes.

Immediate Action: Update the Linux kernel to versions 5.10.261, 5.15.212, 6.1.178, 6.6.145, or newer, depending on the current branch in use.

Proactive Monitoring: Monitor system logs for kernel oops or panic messages that may indicate memory corruption or unexpected termination of security-related processes.

Compensating Controls: Restrict local shell access to untrusted users and enforce strict AppArmor profiles to limit the potential impact of local exploit attempts.

Public Exploit Available: Unknown

Given the severity of potential privilege escalation within the kernel, security teams should prioritize patching affected Linux distributions. Administrators should verify their kernel version and apply the upstream fixes as soon as they are integrated into their specific distribution repositories to mitigate the risk of local exploitation.