Technical impact
This bug occurs in the Linux kernel’s BPF crypto subsystem when the destructor function pointer type does not match the expected signature enforced by CONFIG_CFI. The mismatch triggers a Control‑Flow Integrity violation, causing the kernel to issue an Oops and crash. The primary impact is that any BPF program using the crypto context could abruptly terminate the system, effectively denying service to users or processes that rely on that kernel module. Based on the description, it is inferred that an attacker would need to be able to execute a BPF program that exercises the crypto context to trigger this crash.
Affected Systems
The flaw is present in the core Linux kernel, affecting all distributions that ship a kernel compiled with CONFIG_CFI and that make use of the BPF crypto context destructor. Specific kernel versions are not listed in the data, so any unpatched kernel with this configuration is at risk.
Risk and Exploitability
The EPSS score of < 1% indicates a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, suggesting limited public exploitation. The CVSS score of 5.5 indicates moderate severity. The kernel crash could be triggered by a BPF program that accesses the flawed crypto context destructor. Based on the description, an attacker must be able to load or execute a BPF program that exercises the flawed destructor, which likely requires system access or an environment where custom BPF programs are executed. No publicly documented exploit samples are currently known, so the immediate risk is considered moderate to low, but the denial‑of‑service nature warrants remediation.
