A high-severity integer overflow flaw in the Linux kernel AppArmor subsystem poses a risk of unauthorized information disclosure and system instability to local users.

The vulnerability exists within the verify_tags function, which fails to correctly validate bounds when processing policy blobs. An attacker with local access can supply a crafted count value that triggers an integer wrap, leading to an out-of-bounds read in the kernel memory.

Successful exploitation of this vulnerability allows a local attacker to read arbitrary kernel memory or cause a system crash, resulting in potential information disclosure or denial of service. While the CVSS score of 7.1 indicates a high risk, the requirement for local access (AV:L) somewhat constrains the attack surface to users already present on the system. Nevertheless, in multi-tenant environments or systems where untrusted users have shell access, this vulnerability represents a significant threat to data confidentiality and availability.

Immediate Action: Update the Linux kernel to version 7.2.6 or later to incorporate the security patch.

Proactive Monitoring: Monitor system logs for kernel oops or unexpected service restarts that may indicate attempted exploitation of memory management functions.

Compensating Controls: Restrict local user access to the maximum extent possible and ensure that AppArmor policy loading is limited to highly privileged administrative accounts.

Public Exploit Available: Unknown

This vulnerability highlights the ongoing necessity of maintaining kernel currency in Linux environments. Given the potential for memory corruption and information exposure, organizations should prioritize testing and deploying the kernel fix to all affected servers. Administrators should treat this as a critical maintenance item for systems hosting multiple users or sensitive workloads.