The Linux kernel contains a flaw in the bpf_kprobe_multi_link_attach routine where it fails to confirm that a kprobe_multi program is not marked as sleepable. Because kprobe_multi programs are meant to run in an atomic or RCU context, the missing validation allows a sleepable helper such as bpf_copy_from_user to be invoked, producing a "sleeping function called from invalid context" fatal error that normally triggers a kernel panic.

All Linux kernel builds that include the vulnerable bpf_kprobe_multi logic before the recent patch are impacted. The CNA lists the product as Linux:Linux; version information is not explicitly provided, so any kernel version that does not contain the early‑rejection fix should be considered at risk until updated. The CPE list includes kernel releases such as 7.0 rc1 through rc6, but the vulnerability applies broadly to earlier kernels as well.

The CVSS score of 5.5 indicates moderate severity, while the EPSS score of less than 1% suggests a very low likelihood of public exploitation. The likely attack vector is that an attacker who can load a malicious BPF program—as is typically restricted to privileged users—might exploit the flaw to crash the kernel. This inference comes from the description’s mention of loading BPF programs but does not specify the required privilege level. The vulnerability is not listed in CISA’s KEV catalog, further indicating limited known exploitation. Overall, the risk is moderate but could be high in environments that permit arbitrary BPF program loading without strict access controls.