A flaw in the Linux kernel allowed any user to detach BPF programs from tcx or netkit devices using the BPF_PROG_DETACH mechanism when no program file descriptor was supplied. The kernel performed no capability check in this scenario, so an attacker could remove a BPF program controlling networking behavior without possessing CAP_NET_ADMIN or CAP_SYS_ADMIN, potentially altering packet handling or disrupting network services. The weakness is an improper authorization check (CWE‑284).

The vulnerability is present in the Linux kernel shipped by all vendors before the fix commit. No specific version numbers are disclosed, so all kernels lacking the patch are considered affected.

The issue is a local exploit that can be exploited by any user on the system. There is no public CVSS score, and the EPSS score is not available. The vulnerability is not listed in CISA’s KEV catalog, suggesting no known widespread exploitation to date. Nevertheless, the potential to disrupt network functions or degrade security controls makes the risk moderate, and the attack vector is local user privilege.