In the Linux kernel, the SELinux socket state is stored in a composite Layered Security Module (LSM) socket blob. The functions sock_has_perm() and nlmsg_sock_has_extended_perms() dereference sk->sk_security directly, assuming that the SELinux blob starts at offset zero. When another LSM allocates socket blob space before SELinux, this assumption fails and the helpers read an incorrect blob, feeding erroneous SELinux IDs (SID) and class values into the access control checks. This misreading can cause SELinux to make incorrect access decisions, potentially allowing an attacker to bypass SELinux restrictions and gain unauthorized privileges. Based on the description, it is inferred that the flaw could be exploited to elevate privileges or bypass policy restrictions.

The vulnerability affects Linux kernel systems that run SELinux together with at least one additional LSM module in a stacked configuration. No specific kernel version range is supplied in the CVE data, so the flaw may be present in any kernel release prior to the fix. Systems with multiple LSMs and no enforced ordering of SELinux are at risk.

The CVSS score of 5.5 indicates moderate severity, while the EPSS score of <1% suggests a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack would require local or privileged ability to influence the order of LSM socket blob allocation, pointing to a local privilege escalation scenario. Although the interplay of SELinux and other LSMs limits widespread exploitation, the potential to invalidate SELinux checks warrants prompt remediation.