The vulnerability stems from the BPF test_run interface in the Linux kernel’s XDP code. A userspace BPF program may specify a metadata size larger than the available headroom, not accounting for the xdp_frame structure. Consequently the kernel creates an uninitialized frame that is later used for packet transmission, leading to undefined behavior that typically manifests as a kernel crash or erratic operation, effectively denying service to the affected system.

Any system running the Linux kernel with the bpf_test_run functionality is affected. The known affected CPE identifiers cover all Linux kernel releases, including all stable releases and release candidates up to 6.19 rc5. Systems using a kernel version prior to the applied patch remain vulnerable regardless of distribution.

The CVSS base score of 5.5 indicates a moderate severity, while an EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The vulnerability is not listed in the KEV catalog. Exploitation requires a user or process capable of loading BPF programs, and an attacker could trigger a denial‑of‑service by submitting a malformed BPF test_run configuration.