Never heard of this before, so I never knew I needed to worry about it before today.
Now I know why SNMP R/W access to that one WLC wasn't working... stupid CPU ACL on it didn't allow from my NAC device!
I swear, NAC is going to make a wireless expert out of me...
I was unfamiliar with this terminology as well, and had to look it up:
"Previously, ACLs on WLCs did not have an option to filter LWAPP/CAPWAP data traffic, LWAPP/CAPWAP control traffic, and mobility traffic destined to the Management and AP Manager interfaces. In order to address this issue and filter LWAPP and mobility traffic, CPU ACLs were introduced with WLC firmware release 4.0."