The kernel’s BPF verifier relies on helper function prototypes to determine memory access patterns. Several helper functions lack the appropriate MEM_RDONLY or MEM_WRITE flags, causing the verifier to assume that buffers remain unchanged across helper calls. This false assumption can lead the verifier to incorrectly optimize away subsequent reads, resulting in correctness problems. The weakness is a failure to properly specify memory access semantics, which could allow malicious BPF programs to observe or corrupt data they should not see, thereby impacting confidentiality or integrity of kernel memory.

All Linux kernel releases that have not incorporated the patch commits that add the correct memory access flags in helper prototypes. The fix appears in the kernel source after commit 37cce22dbd51 and related commits such as ac44dcc788b9 and 2eb7648558a7. Until the kernel is updated, systems running older kernels are affected.

The CVSS score is not disclosed, nor is there an EPSS value; the vulnerability is not listed in CISA’s KEV catalog. This indicates limited exploitation evidence. However, because the flaw originates in the core BPF verifier, it has the potential to affect any user mode BPF program that interacts with the kernel. Environments that expose untrusted BPF code or rely heavily on dynamically generated BPF programs should prioritize mitigation, while general usage scenarios may exhibit a lower immediate risk.