In the Linux kernel, the vulnerability involves a time‑of‑check to time‑of‑use error in bpf_map_get_info_by_fd: the kernel calculates and caches a map hash even when the map is not yet frozen. A trusted BPF loader can cache this stale hash with BPF_OBJ_GET_INFO_BY_FD, modify the map contents before freezing, and then load the modified code while the loader still believes the hash is unchanged. This flaw allows an attacker with sufficient privileges to supply malicious BPF data that bypasses integrity checks, potentially allowing integrity manipulation of loader operations. The core weakness is a race, where a check of the map’s state is followed by a use that assumes the same state, without re‑verification.

Linux kernel (all releases prior to the patch that introduces the EPERM return for non‑frozen map hash requests).

The CVSS severity is not specified, and EPSS data is not available, so exploitation probability cannot be precisely quantified. The flaw is not listed in the CISA KEV catalog. Attackers need the ability to create or modify BPF maps and invoke the trusted loader, typically requiring elevated or privileged local access. Given that the bug permits integrity exploitation of kernel loader code, the risk is considered high if the vulnerable kernel is in use.