The Linux kernel’s BPF verifier relies on helper function prototypes to determine when kernel memory is read or written. Several helper prototypes were missing the appropriate MEM_RDONLY or MEM_WRITE flags, so the verifier incorrectly assumed that buffers remained unchanged after the helper call. This misinterpretation causes the verifier to optimize away subsequent reads, potentially leading to correctness or data integrity issues within kernel memory. The flaw is a failure to correctly specify memory access semantics (CWE‑733).

All Linux kernel releases that do not yet contain the patch commits that add the correct memory access flags in helper prototypes (commit 37cce22dbd51 and related commits ac44dcc788b9, 2eb7648558a7). Until the kernel is updated, systems running older kernel versions are affected.

The CVSS score of 6.7 indicates a moderate severity vulnerability. The EPSS score of less than 1% and the fact that it is not listed in CISA’s KEV catalog suggest that exploitation is unlikely at present. Because this bug resides in the core BPF verifier, it could theoretically impact any BPF program loaded into the kernel, but the description does not provide evidence of how an attacker would manipulate BPF code to exploit the flaw.