The vulnerability exists in the GETALL and SETALL commands of the semctl(2) system call, which manage semaphore sets. These commands record the number of semaphores, drop the lock protecting the set, allocate a buffer based on that count, and then reacquire the lock. A sequence-number check is used to verify the set has not been replaced, but this sequence number wraps after 0x8000 create/destroy cycles. By rapidly destroying and recreating semaphore sets at the same index, an attacker can cause the sequence number to wrap, allowing a set with a different semaphore count to pass validation. This leads to out-of-bounds reads or writes on kernel heap memory, which an unprivileged local user can exploit to escalate privileges.

An unprivileged local user can trigger out-of-bounds reads and writes on kernel heap memory, potentially leading to privilege escalation. The vulnerability affects confidentiality, integrity, and availability with high impact as indicated by the CVSS score of 7.8.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict unprivileged local user access and monitor for suspicious activity involving semaphore set operations.