The Linux kernel’s BPF subsystem contains a use‑after‑free flaw in the arena_vm_close routine that is triggered after a fork when a child inherits a BPF arena virtual memory area. Because arena_vm_close dereferences a stale pointer pointing to a VMA that has been unmapped by the parent process, a subsequent call to bpf_arena_free_pages can access freed memory, leading to a kernel crash or local privilege escalation. The weakness originates from improper management of the arena VMA list and lacks defensive checks during VM operations.

The vulnerability affects any Linux kernel build that contains the BPF arena code before the patch series introduced by commit 201128fcc7b213d27ab77bc4e89488b41796480f. All distributions based on the upstream kernel that have not yet upgraded to a version including that commit or later are at risk. Systems running custom kernels or those that compile and load BPF programs which allocate arenas during userland forks, such as network packet classifiers or sandboxed workloads, are particularly susceptible. Customers are encouraged to review their kernel version and whether it includes the VM_DONTCOPY and may_split fixes to determine if the fix has been applied.

The flaw is classified as a use‑after‑free and a memory corruption issue (\"CWE-825\"). It carries a CVSS score of 7.0 and an EPSS score of <1%, indicating a moderate severity but a low probability of exploitation. The attack vector is local; an attacker must be able to run or inject a BPF program that reserves an arena and then fork a process while the parent unmapped it. Once the condition is met, the kernel can be forced to crash or allow the attacker to exploit the dangling pointer to execute arbitrary code with kernel privileges. Although the exploitation path is non‑trivial and no public exploits are known, the potential impact of a successful attack is high, and the vulnerability is not listed in the CISA KEV catalog, suggesting it has not yet been observed in widespread use.