The vulnerability involves the BPF verifier failing to mark the register used by a gotox rX instruction as live, which could lead to incorrect verification decisions. The fix corrects this by ensuring the register is marked as used during liveness analysis. The CVE description does not specify the concrete consequences or scope, so no direct impact such as crashes or data loss is disclosed.

All versions of the Linux kernel that include the BPF subsystem and have not yet incorporated the commit that marks the register as live are affected. The vulnerability is present in all kernels prior to the patch referenced by the commit hashes in the listed references.

The CVE has a CVSS score of 7.8, EPSS score is < 1%, and it is not listed in the CISA KEV catalog. No public exploits are documented. Based on the nature of BPF program loading, which usually requires elevated privileges, it is inferred that an attacker would need such privileges to trigger the bug. The potential impact is limited to systems that allow loading of BPF programs and to situations where the verifier could incorrectly accept a malformed program.