The vulnerability stems from an insufficient permission check when opening namespace handles in the Linux nsfs filesystem. Based on the description, privileged services are able to open handles to other privileged services' namespaces, which they should not be able to. This results in unintended visibility of namespace information, effectively leaking metadata about other services' namespaces. The issue is an example of improper access control and a permission or privilege issue (CWE‑1220).

All Linux kernel installations that have not yet applied the fix are affected. The change is identified in the kernel source, and any kernel version preceding that commit may allow the described permission bypass. Linux is the vendor, and the product is the Linux kernel, although no specific version range is listed.

The CVSS score of 8.8 indicates a high severity vulnerability. The EPSS score of less than 1% suggests that exploitation attempts are currently rare. The vulnerability is not listed in the CISA KEV catalog. An attacker who can run a privileged service can abuse the insufficient permission checks to open handles to other privileged services' namespaces, thereby obtaining metadata about those namespaces. This information disclosure could be leveraged to plan more targeted attacks. The exploitation path requires kernel privilege; therefore environments with multiple privileged services need to apply the fix promptly to mitigate this risk.