The flaw is in the Linux kernel’s BPF subsystem, where the cgroup_storage_get_next_key() routine misidentified the end of a linked list and dereferenced a bogus pointer that overlapped internal map fields. The resulting out‑of‑bounds read copies kernel data into user space, exposing sensitive information but not allowing arbitrary code execution.

All Linux kernels that have not incorporated the commit that replaces list_next_entry() with list_entry_is_head() in the BPF cgroup storage code. Administrators should verify that the running kernel contains the patch that fixed end‑of‑list detection, as any earlier device is vulnerable.

The CVSS score of 5.5 indicates moderate severity, while an EPSS score of less than 1% shows a low but nonzero probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. An attacker who can invoke the BPF interface to query cgroup keys would trigger the misdetection and read kernel memory; the required privileges depend on the system’s BPF key query permissions, but the attack vector is limited to interaction with the BPF subsystem.