In the Linux kernel, the lsm_set_self_attr() function does not acquire the cred_guard_mutex before performing security checks, a flaw now classified as CWE‑412. The omission creates a race condition that could allow a process to alter its own security attributes while a ptrace check is underway. If successful, the attacker might bypass SELinux or AppArmor restrictions and elevate privileges. The severity is high, as the flaw is a concurrency issue rather than a direct memory corruption or input validation bug.

All Linux kernels that ship with SELinux or AppArmor enabled are potentially affected, because the vulnerability resides in the core LSM layer. No specific kernel release is listed in the advisory, so any kernel where the patch has not yet been applied can be at risk.

The CVSS score of 7.1 indicates high severity. The EPSS score of less than 1% suggests a low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is local; an attacker would need to orchestrate a race condition while manipulating process attributes, which is inferred rather than explicitly documented.