A flaw in the Linux kernel’s BPF verifier causes incorrect pruning of program paths when an atomic fetch instruction is used. The verifier fails to propagate the precision of the destination register to the stack, so two program states that differ only in stack content can be treated as equivalent. Based on the description, this could allow an attacker to craft a BPF program that the verifier accepts when it shouldn’t, potentially leading to kernel-level exploitation.

All Linux kernel deployments that use the default BPF verifier. The vulnerability is present in any kernel version prior to the commit that introduced the backtrack_insn fix (180… or 7ffbe45…); the exact affected kernel releases are not specified in the input.

EPSS score is less than 1%, indicating a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog and has no published exploit data yet. The CVSS score is 7.8, indicating a high severity. However, the nature of the bug—an unsoundness in the verifier that can allow unsafe BPF programs to be loaded—means that the risk is high if the system depends on custom or third‑party BPF code. There is no known public exploit, but the potential impact warrants immediate attention.