The vulnerability stems from missing SELinux enforcement on mmap() and mprotect() system calls for overlayfs filesystems, allowing an attacker to map or change the protection of files in a way that bypasses SELinux controls. This can enable a user with local access to read from or write to backing (lower‑level) files that they should not normally be able to, potentially leading to privilege escalation, unauthorized data exfiltration, or modification of protected files.

All Linux kernel releases that support overlayfs and SELinux and have not applied the patch. The issue is not limited to a particular distribution and affects any kernel that implements overlayfs without the new security_mmap_backing_file hook.

The CVSS score is not provided and the EPSS score is unavailable, so precise severity calculations cannot be made, but the Trusted Access Control flaw (CWE-284) is a high‑impact weakness. The vulnerability can be exploited by a local attacker who can create or manipulate overlay mounts; remote exploitation would likely require additional privileges or a misconfigured mount. The flaw is not listed in CISA KEV, but due to its impact on SELinux enforcement it should be treated as serious for systems relying on SELinux to mediate file access.