A race condition vulnerability exists in sblim-sfcb on Red Hat Enterprise Linux 10, where a local low-privileged attacker can exploit insecure temporary file handling during privileged instance migration. By repeatedly recreating a symbolic link in the /tmp directory, the attacker can redirect privileged output to arbitrary files, causing privileged file corruption or denial of service. The attack complexity is high and requires specific conditions, including enabled instance migration and particular repository content. The vulnerability is tracked as CVE-2026-73584 with a CVSS 3.1 score of 6.3 (medium). Red Hat advisory recommends mitigation by disabling instance migration using the sfcbrepos -i option or avoiding elevated sfcbrepos execution when untrusted local users can write to /tmp. No official patch or fix has been published yet.

Successful exploitation can lead to privileged file corruption or denial of service on the affected system. The vulnerability does not impact confidentiality but has high integrity and availability impacts. Exploitation requires local access with low privileges and has high attack complexity due to the need to win a race condition during privileged instance migration. There are no known exploits in the wild at this time.

Red Hat advises mitigating this issue by disabling the vulnerable instance migration path if it is not required. This can be done by running the sfcbrepos command with the -i option (e.g., sudo sfcbrepos -f -i). Alternatively, avoid running sfcbrepos with elevated privileges on systems where untrusted local users can write to the /tmp directory. A service restart or reload may be necessary if sfcbrepos is managed by a service. No official patch or fix is currently available; patch status is not yet confirmed — check the vendor advisory for updates.