The vulnerability is a time‑after‑check to time‑of‑use race in Go’s Root.Chmod function on Linux. An attacker with write access to the target path can replace the file with a symlink while chmod is in progress. The underlying fchmodat syscall ignores the AT_SYMLINK_NOFOLLOW flag, causing permission changes on the linked target even if it lies outside the expected root. Root.Chmod performs a preliminary check of the target’s symlink status and returns an error if the symlink points beyond the root, mitigating the impact, but the race still exists. The main consequence is that an attacker could alter permissions of arbitrary files, potentially aiding privilege escalation. This flaw is classified as CWE‑367 and CWE‑59.

The issue affects the Go programming language’s standard library, specifically the internal/syscall/unix package, on Linux. All Go installations that use Root.Chmod are vulnerable until the patch is applied.

The CVSS score of 6.4 indicates moderate risk, while the EPSS score of less than 1% suggests a low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Attackers would need local write access to the target path and the ability to orchestrate a TOCTOU race; thus it is best mitigated by applying the vendor patch or restricting write permissions.