The vulnerability causes the per‑task audit‑vector cache in SELinux to reuse an incorrectly computed value, so certain permission checks are not logged. If a directory write check follows a previously cached directory search check, the denial may go unaudited. This flaw violates the integrity of audit data and can conceal unauthorized access attempts, potentially enabling attackers to bypass detection. The weakness is classified as CWE‑778, a failed security check to verify conditions.

The flaw affects the Linux kernel with SELinux enabled. No specific kernel versions were listed as affected, so any kernel prior to the fixing commit may be.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score of less than 1% shows a very low probability of exploitation in the wild. The flaw is not listed in the CISA KEV catalog. As the flaw impacts audit logging, an attacker would need a system where SELinux auditing is relied upon for detection. The typical attack surface is any SELinux‑enabled Linux kernel that has not applied this patch, and the attacker would exploit the missing audit trail to conceal privilege escalation or unauthorized writes.