The flaw involved SELinux authorization checks for BPF tokens. When creating a token or loading a program, the kernel looked up the creator’s SID multiple times using the token’s file descriptor. Because the SID information could also be derived from the resolved path or the token data itself, an attacker could exploit a time‑of‑check to time change the file descriptor after permissions were checked, potentially bypassing SELinux policies and gaining higher privileges. The fix removes redundant lookups and eliminates the race, ensuring correct permission enforcement.

All Linux kernel releases that contain the obsolete SELinux BPF token code are affected, regardless of distribution. The fix was applied to the kernel source in the referenced commits. Users running kernel versions prior to these changes are impacted.

The vulnerability is not listed in CISA’s KEV catalog and has no EPSS score available, indicating low exploitation likelihood as of the last assessment. Exploit requires the ability to load eBPF programs and manipulate token file descriptors, a capability generally limited to privileged users. The CVSS score is not provided, but the focus on SELinux authorization suggests a moderate severity if exploited. Applying the fixed kernel version removes the flaw and eliminates potential privilege escalation.