bpf_core_parse_spec() in the Linux kernel incorrectly accepts negative values in CO‑RE accessor strings because the sscanf("%d") conversion silently permits them and the subsequent bounds checks only guard the upper limit. A negative index is treated as an unsigned value far beyond the bounds of the target array, causing an out‑of‑bounds read inside btf_member_bit_offset(). The kernel OOPS occurs during BPF program load, resulting in a deterministic crash whenever a user with CAP_BPF supplies a BPF program that contains a negative CO‑RE index on any struct present in the BTF data.

As the vulnerability is in the generic Linux kernel, all distributions that ship a kernel with CONFIG_DEBUG_INFO_BTF=y (the default on most modern releases) are affected. The bug can be triggered on any kernel version prior to the fix, regardless of specific release series, as long as the kernel contains the unpatched bpf_core_parse_spec function.

The bug requires a program that makes a BPF syscall with CAP_BPF, so an attacker needs privileged capabilities or must compromise a process that runs as root. This makes the attack surface limited to privileged users, but many observability or networking tools load BPF programs at start‑up, so accidental or intentional exploitation is possible. The severity is high because the kernel crashes, yet EPSS data is currently unavailable and the vulnerability is not listed in the CISA KEV catalog. A patched kernel or a mitigation that removes the offending BPF program will prevent the crash.