The Linux kernel’s fanotify subsystem allows a mark to be incorrectly associated with the current group, causing the kernel to skip a permission check. An attacker who can create or modify fanotify marks may therefore access files or perform actions without the required authorities, effectively elevating privileges or bypassing intended access controls. Based on the description, it is inferred that the attack requires the ability to create or manipulate fanotify marks, a capability generally available only to local users with appropriate permissions.

This vulnerability affects all versions of the Linux kernel that have not incorporated the patch fixing fsnotify_get_mark_safe() to skip detached marks. No specific release range is given, so any kernel with the unresolved flaw is potentially affected.

The flaw has a CVSS score of 7.1 and an EPSS of <1%, indicating moderate severity with a very low estimated exploitation likelihood. Because it is not listed in the CISA KEV catalog, no widespread exploitation has been documented. An attacker must have the ability to interact with the fanotify interface—generally a local or privileged user—to trigger the bypass. If exploited, the attacker can gain unauthorized access to protected resources on the affected system.