A race condition vulnerability exists in sblim-sfcb on Red Hat Enterprise Linux 10, allowing a local low-privileged attacker to exploit insecure temporary file handling during privileged instance migration. By repeatedly recreating a symbolic link in the /tmp directory, the attacker can redirect privileged output to arbitrary files, leading to privileged file corruption or denial of service. The attack requires winning a time-of-check-to-time-of-use (TOCTOU) race during sfcbrepos instance migration, which must be enabled and have specific repository content. The vulnerability has a CVSS 3.1 score of 6.3 (medium severity) with high attack complexity and low privileges required. Red Hat advises mitigating by disabling instance migration via the sfcbrepos -i option or avoiding elevated sfcbrepos execution where untrusted users can write to /tmp. No official patch or fix is currently documented in the vendor advisory.

Successful exploitation can cause privileged file corruption or denial of service on the affected system. The vulnerability does not impact confidentiality but affects integrity and availability. The attack requires local access with low privileges and has high complexity due to the need to win a race condition during privileged instance migration. This limits the broader impact of the vulnerability.

Red Hat recommends mitigating this issue by disabling the vulnerable instance migration path if it is not required, using the command 'sudo sfcbrepos -f -i'. Alternatively, avoid running sfcbrepos with elevated privileges on systems where untrusted local users can write to the /tmp directory. A service restart or reload may be necessary if sfcbrepos is managed by a service. No official patch or fix is currently available; patch status is not yet confirmed — check the vendor advisory for updates.