sblim-sfcb EUVD-2026-57829

The attacker must hold a local OS account with at least low-level shell privileges on the target system (PR:L per CVSS vector). The sblim-sfcb daemon (sfcbd) must be installed, running, and must execute a privileged instance migration operation - exploitation is contingent on this migration being in progress or triggerable. The /tmp filesystem must permit symbolic links created by unprivileged users to be followed by privileged processes, meaning the fs.protected_symlinks kernel parameter must be unset or set to 0, which is the default on many RHEL deployments. High attack complexity (AC:H) limits exploitation: the attacker must win a timing race that requires repeated automated attempts and cannot be reliably triggered on a single try. Remote exploitation is impossible - physical or authenticated SSH-level local access is a hard prerequisite. Confidentiality impact is structurally absent: the attacker redirects writes but cannot read privileged data through this path.

The CVSS 3.1 vector AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H accurately characterizes the threat: exploitation requires local shell access with at minimum low OS privileges, and AC:H reflects the genuine timing difficulty of winning a race condition window, which requires automation and repeated attempts. The impact scope is limited to integrity and availability with no confidentiality loss, consistent with a write-redirect attack that corrupts rather than leaks data. No EPSS score was provided in the available input, and this CVE is absent from the CISA KEV catalog, meaning exploitation probability and active-exploitation status remain unquantified. The combination of AC:H and a local-only vector (AV:L) meaningfully reduces urgency relative to a network-exploitable flaw - however, organizations running shared RHEL infrastructure with sblim-sfcb active should not dismiss this: even a mid-sized municipal IT team in leszno operating WBEM-enabled servers would be exposed to insider-threat or post-compromise privilege-chaining scenarios where this vector becomes relevant. The availability of kernel-level mitigations (fs.protected_symlinks) provides a practical interim control that reduces real-world exploitability substantially.

A local attacker with a standard low-privileged shell account on an RHEL system running sblim-sfcb launches a tight loop that continuously creates and replaces a symlink at the predictable /tmp path used during privileged instance migration. When the sfcbd daemon initiates a migration - either on a natural schedule or triggered by the attacker through a legitimate CIM operation - the daemon's privileged file write is redirected by the winning symlink to an attacker-chosen path such as /etc/cron.d/, /etc/sudoers.d/, or a critical configuration file, resulting in corruption of that file or a system denial of service. No public exploit code has been identified at time of analysis, but the attack pattern is a well-understood and readily scriptable class of TOCTOU symlink exploit requiring no specialized tooling.