A flaw in libcap’s cap_set_file() implementation creates a time‑of‑check-to-time‑of‑use race condition. A local, unprivileged user who can write in the parent directory of a capability file can redirect capability updates to an attacker‑controlled file, thereby injecting or stripping capabilities from executables and obtaining elevated privileges. This vulnerability is a classic race condition, identified as CWE‑367.

Red Hat Enterprise Linux versions 6 through 10, Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4 are listed as affected. Any system running the vulnerable version of libcap within these products is vulnerable; the user does not need initial elevated rights beyond write access to the relevant directory.

The CVSS score is 6.7, indicating moderate severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires local access and the ability to write in a directory that contains capability files; no publicly known exploits exist yet. Since no official workaround is available, the risk persists until the patch is applied. Users should monitor for updates and consider restricting file‑level write permissions as a temporary measure.