The issue is related to a race condition that allows local attackers to execute arbitrary code as root by tricking needrestart into running a fake Python interpreter. This is achieved by winning a race condition and substituting the system's real Python interpreter with a malicious one. The initial security fix introduced a regression, which was subsequently resolved.