The Linux kernel BPF subsystem suffers a use‑after‑free condition in the bpf_trampoline_link_cgroup_shim routine. When bpf_link_put drops the reference count of a shim link to zero, the associated trampoline program list is not cleaned up immediately. During that brief window, another process can invoke bpf_trampoline_link_cgroup_shim and access freed memory, potentially causing kernel memory corruption or a crash. The weakness is a use‑after‑free (CWE‑416) and is also noted as CWE‑825 in the advisory.

The vulnerability applies to the Linux kernel. The affected versions are kernel 6.0 and all 7.0 release candidates from rc1 through rc7. Administrators should verify whether their running kernel includes any of these versions and whether the patch commits that fix the bpf_trampoline_link_cgroup_shim code have been applied; updating to a kernel that contains the referenced patch commits is the recommended approach.

The CVSS v3.1 score of 7.8 indicates high severity, yet the EPSS score is below 1%, implying a low probability of exploitation in the wild. It is inferred from the nature of the use‑after‑free issue and the requirement to load BPF trampoline programs that the attack vector would be local with elevated privileges or kernel exploitation. No publicly available exploit has been reported and the vulnerability is not listed in the CISA KEV catalog, suggesting that widespread exploitation has not occurred.