An eBPF verifier bug arises when a BPF_END operation, which swaps byte order, mutates a register's scalar value without resetting its identifier. When the original register shares its scalar ID with another register, the verifier fails to break this link, causing propagated bounds to be incorrectly trusted. Based on the description, it is inferred that a malicious eBPF program that performs such operations and manipulates conditional jumps could exploit the flaw, potentially enabling out-of-bounds read or write in kernel space.

The vulnerability exists in the Linux kernel across all versions prior to the commit that introduced an explicit reset of dst_reg->id during BPF_END handling. The affected product is the Linux kernel.

It is inferred that EPSS indicates a low likelihood of exploitation with a score of <1%, and the CVSS score is 7.8. The kernel-level flaw carries a high inherent risk; an attacker who can load custom eBPF code with sufficient privileges could trigger the bug to gain arbitrary kernel memory access. It is inferred that the attack vector is therefore any local or remote service that allows user-land processes to submit eBPF programs to the kernel, such as through socket filters or BPF maps. The exploitable condition requires the attacker to craft a program that performs a BPF_END on a register tied to another register and then uses a conditional jump that is incorrectly evaluated by the verifier.