This flaw exists in the Linux kernel’s BPF verifier when the function maybe_fork_scalars handles BPF_OR instructions with constant operands. The verifier incorrectly forks scalar state, assigning a destination register a value of zero on a pushed path while the current path receives a signed value of minus one. For BPF_OR, this produces the wrong result, causing the verifier to diverge from real runtime execution and permitting an eBPF program to perform an out‑of‑bounds map access. The vulnerability is an instance of unsound scalar forking (CWE‑131) that can lead to memory corruption.

All Linux kernel installations are potentially affected, though the CVE data does not specify particular kernel releases or version ranges. No version constraints are listed, so any kernel containing the vulnerable verified path code is at risk.

The likelihood of exploitation is low (EPSS < 1 %) and the vulnerability is not included in CISA’s KEV catalog. Nevertheless, because it allows a kernel developer or privileged user to craft an eBPF program that reads or writes beyond map bounds, it can lead to privilege escalation or denial of service. The attack vector is most likely local, requiring execution of a malicious eBPF program that uses the BPF_OR opcode on constant operands. Identification of the vulnerability requires knowledge of eBPF verifier internals, but once present, the divergence can be exploited without additional system compromise. The CVSS score of 7.8 indicates a high severity vulnerability.