The flaw occurs because SELinux does not enforce control checks on the mmap() and mprotect() system calls used with files on overlayfs mounts. Consequently, a process that can influence an overlayfs setup may map or alter the protection of files residing on the lower (backing) filesystem, bypassing SELinux policy. This enables the attacker to read or write data that should be protected, and in some scenarios may allow escalation of privileges beyond the intended access level.

All Linux kernel releases that implement SELinux with overlayfs support and have not yet been patched, regardless of distribution. The vulnerability applies to any kernel that handles overlayfs without the security_mmap_backing_file hook.

The CVSS score of 7.1 indicates high severity. The EPSS score of 0.00018 indicates a very low but non-zero likelihood of exploitation. The vulnerability is not listed in CISA KEV. Because the vulnerability requires control of an overlayfs mount, the likely attack vector is inferred to be local and requires the attacker to have the ability to mount or configure overlayfs. No public exploitation evidence is documented. The missing SELinux checks represent a Trusted Access Control weakness (CWE‑280).