An eBPF verifier bug arises when a BPF_END operation, which swaps byte order, mutates a register's scalar value without resetting its identifier. When the original register shares its scalar ID with another register, the verifier fails to break this link, causing propagated bounds to be incorrectly trusted. This flaw can be exploited by a malicious eBPF program that performs such operations and then manipulates conditional jumps to access memory addresses outside the intended bounds. The result is an out‑of‑bounds read or write in kernel space, which could lead to data leakage or elevation of privilege.

The vulnerability exists in the Linux kernel across all versions prior to the commit that introduced an explicit reset of dst_reg->id during BPF_END handling. The affected product is the Linux kernel.

No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog. Although a precise CVSS score is not provided, the kernel‑level flaw carries a high inherent risk; an attacker who can load custom eBPF code with sufficient privileges could trigger the bug to gain arbitrary kernel memory access. The attack vector is therefore local or remote service that allows user‑land processes to submit eBPF programs to the kernel, such as through socket filters or BPF maps. The exploitable condition requires the attacker to craft a program that performs a BPF_END on a register tied to another register and then uses a conditional jump that is incorrectly evaluated by the verifier.