The vulnerability is a time‑of‑check time‑of‑use race condition in the Linux kernel that allows an attacker with local access to elevate their privileges. The flaw does not enable remote code execution, denial of service, or other remote attacks; its impact is strictly confined to gaining higher authority on the affected system. The concurrency error is a classic example of CWE‑367, where the kernel fails to guard a critical window between checking a condition and using its result.

The flaw affects Microsoft Linux 3P (Third Party) distributions and the Microsoft Linux kernel MANA Network Driver. No specific version ranges are listed in the CNA data, so all installations of these products could potentially be vulnerable until a patch is applied.

The CVSS score of 7 categorizes the vulnerability as High severity. The EPSS score is <1 %, indicating a very low likelihood of abuse at the time of analysis. The flaw is not present in the CISA KEV catalog. Exploitation requires a local, authenticated user or process that can trigger the race on a kernel component; the narrow timing window makes it difficult to weaponize, yet it remains a significant risk for any local user or service with sufficient privileges.