The Linux kernel's fanotify subsystem contained a flaw where fsnotify_get_mark_safe() could mistakenly report that a mark belonged to an unrelated group, thereby allowing an attacker to bypass permission checks on certain filesystem events. This bypass provides unauthorized access to protected resources, effectively granting an attacker higher privilege than intended for that operation.

The vulnerability applies to the Linux kernel itself. No specific kernel release information was provided, so any deployment of the Linux kernel that has not already incorporated the fix may be affected.

The exploit requires interacting with the fanotify interface, implying a local or privileged attacker could trigger the bug. Because EPSS data is unavailable and the issue is not listed in CISA KEV, the likelihood of widespread exploitation is currently unclear. Nonetheless, the absence of a proper authorization check can have severe confidentiality and integrity implications for affected systems. The safe path is to ensure the kernel has been updated to a version that includes the patch.