The Linux kernel’s eBPF JIT compiler does not blind 32‑bit immediate values written with the PROBE_MEM32 variant when the hardening flag bpf_jit_harden is enabled. This oversight allows a malicious eBPF program to leave a 32‑bit immediate value unblinded and write it directly to an arbitrary kernel memory address, resulting in kernel memory corruption.

The vulnerability applies to Linux kernel binaries that include the BPF JIT implementation with bpf_jit_harden set to 1 or higher and that have not yet incorporated the patch that adds blinding support for the PROBE_MEM32 store case. Because the input does not list specific kernel release numbers, any kernel version containing the unblinded store path before the fix is considered potentially affected.

With a CVSS score of 5.5, the severity of this flaw is moderate. The EPSS score of less than 1 % indicates a low probability of exploitation in the wild, and the vulnerability is not catalogued in the CISA KEV list. The likely attack vector is the execution of a crafted eBPF program that uses the unblinded PROBE_MEM32 store instruction; no confirmed exploits are reported, but kernel memory corruption could compromise system integrity.