The Linux kernel’s procfs subsystem triggers the ptrace_may_access() function without acquiring the exec_update_lock in several code paths. This missing synchronization can create a race condition where the permission check performed by ptrace_may_access() may return an incorrect result, potentially allowing a process to gain unauthorized ptrace privileges or read information from other processes. The CVE description does not explicitly state the exact outcome of the race, so the potential impact is inferred from the nature of the function involved.

Any Linux kernel that does not include the exec_update_lock protection in the procfs functions listed—do_task_stat, proc_pid_wchan, proc_map_files_lookup, proc_map_files_readdir, proc_ns_get_link, and proc_ns_readlink—may be vulnerable. The advisory does not specify a version range, so any build prior to the protective changes could be vulnerable.

The EPSS score is reported as less than 1%, indicating a very low probability of exploitation at the time of this analysis. The vulnerability is not listed in the CISA KEV catalog. The CVSS base score of 5.5 indicates a medium severity, suggesting that while the potential impact of a successful exploit is significant, the overall risk is lower compared to higher severity scores. Exploitation would likely require a local user with access to /proc entries and the ability to time a race between a permission check and a change in process state. Because the attack surface is local and depends on precise timing, the practical risk remains low, though the potential impact of inaccurate permission checks could be serious if an attacker obtains unauthorized ptrace access.