An alignment oversight in the Linux kernel’s BPF JIT allocator for the arm64 architecture causes a 64‑bit pointer field in the bpf_plt structure to sometimes be misaligned. When the JIT compiler generates code that accesses this field concurrently with a write, the ARM64 load/store operation may observe only part of the 64‑bit value, resulting in a torn read. The malformed address can then be used as a jump target by the JITed code, allowing execution of unintended instructions. This flaw enables an attacker who can load a malicious BPF program to potentially execute arbitrary kernel code, leading to local privilege escalation or root compromise.

The vulnerability affects the Linux kernel across all releases that contain the buggy JIT allocation code for arm64. Vendors and users running these kernel versions are impacted. Specific version ranges are not listed in the CVE data, so any kernel prior to the patching commit should be considered vulnerable.

With a CVSS score of 7.8, the flaw is classified as high severity. The EPSS estimate is below 1 %, and it is not currently listed in CISA’s KEV catalog, indicating a low likelihood of widespread exploitation at this time. Nevertheless, the attack vector requires the ability to load or influence BPF code in kernel space, which an attacker may obtain via local compromise or privilege escalation channels. If the ability to execute BPF programs is available, the misaligned JIT buffer becomes a viable vector for kernel arbitrary code execution. Patching the kernel removes the misalignment; failing that, disabling BPF JIT on affected systems mitigates the risk.