The vulnerability arises when binfmt_misc clones an interpreter file and incorrectly handles write permissions. During the cloning process, a denial to write access is applied while the corresponding allowance is omitted, which can reduce the interpreter inode's write quota and eventually make the file permanently unwritable. Based on the description, it is inferred that an interpreter concurrently open for writing will cause subsequent execs through that binfmt entry to fail with ETXTBSY, disrupting any binaries that rely on that interpreter. The weakness involves improper access control (CWE‑911).

All Linux kernel releases before the patch are affected, regardless of distribution. The flaw exists in the core kernel source, so any system running an unpatched kernel is at risk.

Based on the description, it is inferred that the attack vector is local or requires sufficient file‑system access to set up a pre‑content watch. The CVSS score of 5.5 indicates medium severity. The EPSS score of < 1 % suggests a low probability of exploitation, and the vulnerability is not listed in CISA KEV, further supporting the low exploitation likelihood. An attacker able to influence the interpreter file could cause all dependent binaries to fail, but the vulnerability does not provide remote code execution or privilege escalation.