IBM i versions 7.3, 7.4, 7.5, and 7.6 contain a TOCTOU race condition (CWE-367) that may allow a local attacker to obtain ownership of arbitrary file system objects. This occurs due to a timing issue between the check of a resource and its subsequent use, potentially enabling privilege escalation or unauthorized file manipulation. The CVSS 3.1 base score is 6.0, reflecting a medium severity with network attack vector, high attack complexity, low privileges required, no user interaction, and impacts on confidentiality, integrity, and availability.

A local attacker could exploit this TOCTOU race condition to gain ownership of arbitrary file system objects, potentially leading to unauthorized access or modification of files. The vulnerability affects confidentiality, integrity, and availability but requires local access and has a high attack complexity, limiting the ease of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, administrators should monitor IBM advisories for updates. Until a fix is available, restrict local access to trusted users only to reduce risk.