The Linux kernel’s eBPF JIT compiler contains a flaw where 32‑bit immediates written via the BPF_PROBE_MEM32 mode bypass the blinding mechanism when bpf_jit_harden is enabled. This allows a hostile eBPF program to inject a constant that is written directly into kernel memory without modification, creating an unblinded kernel write and potentially corrupting kernel data structures. As a result, an attacker can achieve arbitrary kernel memory writes that may lead to privilege escalation or other disruptive effects.

Any Linux kernel that was built before the commit adding comprehensive blinding for PROBE_MEM32 stores is affected. The vulnerability is present in kernel versions that enable bpf_jit_harden (typically ≥1) and provide JIT compilation, such as x86‑64 and other architectures that utilize the eBPF JIT. The advisory does not list specific version ranges, so all kernels older than the patched release should be reviewed.

The EPSS score for this issue is less than 1%, suggesting a relatively low chance of widespread exploitation. The vulnerability is not included in the CISA KEV catalog, and no public exploits have been documented. Because the flaw requires the ability to load or influence eBPF programs, the attack surface is naturally limited to privileged users or applications with CAP_SYS_ADMIN. However, for systems that run user‑managed eBPF code, the risk of kernel memory corruption remains significant and should be treated seriously.