This flaw exists in the Linux kernel's BPF verifier when the function maybe_fork_scalars handles BPF_OR instructions with constant operands. The verifier incorrectly forks scalar state, assigning a destination register a value of zero on a pushed path while the current path receives a signed value of minus one. For BPF_OR, this produces the wrong result, causing the verifier to diverge from real runtime execution and permitting an eBPF program to perform an out-of-bounds map access. The vulnerability is an instance of unsound scalar forking (CWE-131) and violations of buffer bounds (CWE-125) that can lead to memory corruption.

All Linux kernel installations are potentially affected, though the CVE data does not specify particular kernel releases or version ranges. No version constraints are listed, so any kernel containing the vulnerable verified path code is at risk.

The likelihood of exploitation is low (EPSS < 1 %) and the vulnerability is not included in CISA’s KEV catalog. Nevertheless, because it allows a kernel developer or privileged user to craft an eBPF program that reads or writes beyond map bounds, it can lead to privilege escalation or denial of service. The likely attack vector is local, requiring the execution of a malicious eBPF program that uses the BPF_OR opcode on constant operands. Based on the description, it is inferred that the exploit requires an understanding of eBPF verifier internals; once the divergence is present, the attacker can exploit it without additional system compromise. The CVSS score of 7.8 indicates a high severity vulnerability.