A race condition in sblim-sfcb allows a local low‑privileged user to manipulate a temporary file in the /tmp directory during privileged instance migration. By repeatedly recreating a symbolic link, the attacker can redirect privileged output to an arbitrary file, causing privileged file corruption or inducing a system‑wide denial of service. The flaw is classified as insecure temporary file handling (CWE‑377).

Red Hat Enterprise Linux 10, 6, 7, 8, and 9 are affected by this vulnerability, as they include the sblim-sfcb package vulnerable to the race condition.

The CVSS score of 6.3 indicates moderate severity, and the lack of an EPSS score means no publicly available exploitation data exists yet. The vulnerability is local and requires an untrusted local user who can write to /tmp while sfcbrepos runs with elevated privileges. Because it is not listed in the CISA KEV catalog, it has not yet been seen in widespread attacks, but the risk remains significant for organizations that run sfcbrepos on multi‑user hosts. The recommended mitigation is to disable the migration path or avoid running sfcbrepos as root when untrusted users can affect /tmp.