The glibc dynamic loader contains a time‑of‑check to time‑of‑use race that can be exploited when the AT_SECURE flag is set. During $ORIGIN expansion in DT_RPATH, the loader verifies a normalized path against trusted directories but then opens the raw, un‑normalized path. A local attacker can place a setuid or setgid binary in a directory they control, hard‑link it so that the race wins, then replace an intermediate component with a symbolic link. This forces the loader to resolve a path outside the trusted directory and load an attacker‑controlled shared object, which runs with the privilege of the binary. The flaw does not allow remote exploitation and requires that fs.protected_hardlinks be disabled, a setting that most production systems enable by default.

Vulnerable products are the GNU C Library (glibc) versions 2.14 through 2.44 on any Linux‑based distribution that ships setuid or setgid executables whose DT_RPATH uses $ORIGIN followed by ".." traversal. Populated systems often include common distributions such as Red Hat, Ubuntu, Debian, and CentOS where glibc is shared across many applications.

The CVSS score of 6.3 reflects a moderate severity, but the exploit requires a local attacker with the ability to hard‑link a specific binary and a system where the protective sysctl is disabled. Because major distributions enable fs.protected_hardlinks by default and the vulnerability is not listed in CISA KEV, the current risk is lower than the theoretical impact would suggest. Nonetheless, the flaw can be leveraged to execute arbitrary code with elevated privileges if conditions are met. Administrators must consider the local environment and whether setuid binaries with $ORIGIN and traversal are present, and should review the EPSS inquiry or vendor advisories for updated metrics.