In the Linux kernel’s BPF subsystem, the function regsafe() incorrectly reports a packet pointer as safe when it points beyond the end of a packet. This logic error can cause BPF programs to operate on memory ranges that have not been properly validated, potentially allowing a malicious program to read or write outside the intended packet boundaries. The result is an unintended kernel memory disclosure or corruption that can be leveraged to compromise system integrity or confidentiality.

All Linux kernel distributions are impacted, as the issue is present in the core kernel code. No specific version range is listed in the advisory; users should update to any kernel release that incorporates the commit referenced in the kernel git history.

The vulnerability is a local flaw that requires the execution of a BPF program, typically delivered through a socket filter or tracing interface. No public exploit has been documented, and the EPSS score is not available, implying limited known exploitation. However, because the flaw can lead to kernel memory corruption, the potential impact is high. The CVSS score is not provided, but the nature of the bug indicates a high severity risk for systems that allow untrusted BPF program execution. The lack of a KEV listing suggests that it has not yet been targeted in known exploit campaigns.