bpf_core_parse_spec() in the Linux kernel incorrectly accepts negative values in CO‑RE accessor strings because the sscanf("%d") conversion silently permits them and the subsequent bounds checks only guard the upper limit. A negative index is treated as an unsigned value far beyond the bounds of the target array, causing an out‑of‑bounds read inside btf_member_bit_offset(). The kernel OOPS occurs during BPF program load, resulting in a deterministic crash whenever a user with CAP_BPF supplies a BPF program that contains a negative CO‑RE index on any struct present in the BTF data.

As the vulnerability is in the generic Linux kernel, all distributions that ship a kernel with CONFIG_DEBUG_INFO_BTF=y (the default on most modern releases) are affected. The bug can be triggered on any kernel version prior to the fix, regardless of specific release series, as long as the kernel contains the unpatched bpf_core_parse_spec function.

The bug requires a program that makes a BPF syscall with CAP_BPF, so an attacker needs privileged capabilities or must compromise a process that runs as root. This limits the attack surface. The impact of a successful exploit is a deterministic kernel crash during BPF program load, resulting in a denial of service. The EPSS score is < 1%, and the vulnerability is not listed in KEV. The severity is high due to the kernel crash.