Udev in systemd versions prior to 260 allows a local attacker to elevate privileges to root by exploiting malicious hardware devices and unsanitized kernel output. The flaw is based on improper handling of device creation events, leading to execution of code with system-level privileges. The weakness is classified under CWE‑250 and CWE‑669, indicating that a vulnerability in giving insufficient root privileges and unsafe handling of user data can cause unintended privilege escalation.

All installations of systemd older than version 260 are vulnerable. System administrators should verify the current systemd version on their hosts and confirm whether it falls below the recommended release before applying a fix.

The CVSS score of 6.4 indicates a medium severity, while the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, further indicating limited exploitation activity. Based on the description, the likely attack vector is a local attacker with physical or administrative access who can attach a malicious hardware device, allowing the attacker to trigger the kernel output handling path. An exploit would result in root escalation, compromising system confidentiality, integrity, and availability.