The kernel’s BPF verifier incorrectly refines register bounds when a JSET instruction narrows a tnum. The verifier mistakenly applies inconsistent ranges to a path that is theoretically unreachable, producing misleading bounds that could let a crafted BPF program pass verification. If a malicious BPF program is accepted, it may execute unintended kernel code or corrupt kernel memory, resulting in privilege escalation or denial of service. The flaw is a logic error in the verifier’s range‐refinement routine.

Any Linux kernel prior to the merge of the range‐forgetting change is vulnerable. The patch was introduced in the mainline kernel and rolled into recent release streams, so systems running earlier kernels lack the fix.

The CVSS score of 5.5 indicates medium severity, while the EPSS score of less than 1% shows exploitation is unlikely under ordinary circumstances. The issue is not listed in the CISA KEV catalog. Exploitation would require a local user or root to construct and load a custom BPF program; the attack is sophisticated and relies on precise manipulation of verifier state, making it a targeted local threat.