The CVSS 5.4 rating for this container-runtime path traversal obscures a case where the technical severity calculus conflicts with the operational reality of containerized AI infrastructure. The 'subsequent system impact: none' in the CVSS vector is internally inconsistent with the high confidentiality, integrity, and availability ratings—the contradiction stems from the CVSS framework assuming a boundary between the vulnerable component and the host that container runtimes do not respect. A path traversal in a container runtime isn't merely a local file read; it can become a container-escape primitive because the runtime already holds capabilities the kernel considers privileged (CAP_SYS_ADMIN, namespace manipulation, overlay filesystem mounts). The 'Ring 3: User Applications' classification in the CVE text describes least-privileged user space, but the affected process operates with kernel-adjacent privileges that make this taxonomy meaningless.
The authenticated-user prerequisite deserves particular scrutiny. In Gaudi ML infrastructure, workloads are submitted through job schedulers running under service principals, not interactive human sessions. The 'authenticated user' condition is architecturally nonexistent in production environments where training jobs execute automatically—the attacker model CVSS assumes (human operator, credential theft, interactive session) does not map to how these systems operate in production. A scheduled training job exploiting the path traversal doesn't require additional authentication; it already has the access the runtime mediates.
The blast radius extends beyond vertical escape to the host. Gaudi accelerators expose shared memory, host-accelerator DMA channels, and RDMA fabric for multi-card training. A container escape in this environment can reach gradient state from concurrent training jobs, model weights in shared memory, or other tenants' workloads via the accelerator interconnect. CVSS has no construct to express accelerator-memory cross-contamination or RDMA-mediated lateral movement.
The practical consequence: organizations patch against severity ratings, and a 5.4 enters a different queue with different SLA treatment. In specialized Gaudi infrastructure requiring coordination between firmware updates, driver compatibility, and runtime patches, that queue moves slowly. The 'medium' rating validates that deprioritization retroactively, extending the exposure window during which a tractable path traversal exploit can mature into a full container escape. Treat this as an 8.x vulnerability in multi-tenant or shared Gaudi training environments regardless of the CVSS score.