A time‑of‑check to time‑of‑use race condition in IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 allows a local attacker to gain root privileges. The flaw consists of an uncontrolled transition between a security check and the use of the resource, enabling the attacker to manipulate the outcome. The vulnerability is classified as CWE‑367 and could lead to full system compromise on the affected hosts.

The affected products are IBM AIX 7.2.x and 7.3.x, including all sub‑versions up to SP13 for 7.2 and SP5 for 7.3 TL02, as well as IBM PowerVM VIOS 4.1.0, 4.1.1 and 4.1.2. The specific fix levels listed by IBM use Service Packs for AIX and Fix Packs for VIOS ranging from 4.1.0.50 to 4.1.2.20, and are cumulative with all earlier security fixes.

The CVSS score of 7.3 indicates a high severity for privilege escalation. The EPSS score is not available, but no known exploitation attempts are reported in the KEV catalog, suggesting that exploitation is possible but currently undocumented. The attack vector is local; the bug requires the attacker to have system access, probably through a compromised user that can execute code on the same machine. Once the race is exploited, the attacker acquires root privileges and can modify or delete any system resource.