The underlying flaw is a race condition in the key creation routine of the Linux kernel, which permits a user with write access to a destination keyring to bypass restriction checks and link a key even when a reject‑all restriction is in place. This flaw effectively allows the insertion of unauthorized keys, potentially giving the attacker elevated privileges or access to sensitive data. The weakness corresponds to a concurrency or race condition failure, formally classified as CWE‑362.

All Linux kernel implementations containing the affected add_key implementation are impacted. The patch was demonstrated against kernel version 7.2.8 and applies to earlier releases with the same code path. No specific vendor or product version list is provided, so systems running any version of the Linux kernel should verify whether the fix has been applied by reviewing the kernel changelog for the relevant commit.

The EPSS score is <1% and the vulnerability is not listed in CISA’s KEV catalog, indicating that no widespread exploitation is currently known. Because the condition requires a local user with write permission to a keyring and relies on a precise timing window, the likelihood of successful exploitation in practice is low to moderate. Nevertheless, the impact of a successful attack is significant, elevating privileges and allowing unauthorized key manipulation. The CVSS score is 2.5, indicating a low severity rating in typical vulnerability scoring models.