The Linux kernel’s BPF verifier omitted lock validation when a BPF subprogram throws an exception, allowing the bpf_throw() routine to unwind the stack without releasing user‑acquired locks. This omission leaves RCU, preempt, and IRQ locks held, which can impede subsequent kernel operations and potentially trigger system instability or denial‑of‑service scenarios. The flaw is a resource‑management defect that compromises synchronization guarantees within the kernel.

All Linux kernel distributions that have not incorporated the commit introducing the fix are affected. The vulnerability exists in any kernel release in which a static BPF subprogram can invoke bpf_throw() and the check_resource_leak routine bypasses lock checks. Consequently, any system running an unpatched kernel prior to the merge of the described commit is potentially susceptible.

The CVSS score of 7.0 indicates moderate risk, and the EPSS score of < 1% suggests a very low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog, indicating no known exploitation. However, the flaw requires that an attacker has permission to load custom BPF programs; a malicious actor with that capability could craft a subprogram that intentionally throws an exception, causing lock leaks that degrade performance or lead to a kernel crash. Based on the description, it is inferred that the attack vector is local to the host and that the attacker must have the privilege to load BPF programs. The attack hinges on the execution of malformed or malicious BPF code.