The Linux kernel BPF subsystem suffers a use‑after‑free condition in the bpf_trampoline_link_cgroup_shim routine. When bpf_link_put drops the reference count of a shim link to zero, the associated trampoline program list is not cleaned up immediately. During that brief window, another process can invoke bpf_trampoline_link_cgroup_shim and access freed memory, potentially causing kernel memory corruption or a crash. The weakness is recorded as CWE‑825.

The vulnerability applies to the Linux kernel. The advisory does not enumerate specific kernel versions that contain the defect, so administrators must determine whether their running kernel includes the unpatched bpf_trampoline_link_cgroup_shim code. Updating to a kernel that contains the referenced patch commits is the recommended approach.

The CVSS v3.1 score of 7.0 indicates high severity, yet the EPSS score is below 1%, implying a low probability of exploitation in the wild. It is inferred from the nature of the issue and the requirement to load BPF trampoline programs that the attack vector would be local with elevated privileges or kernel exploitation. No publicly available exploit has been reported and the vulnerability is not listed in the CISA KEV catalog, suggesting that widespread exploitation has not occurred.