In the Linux kernel, BPF signatures can be made arbitrarily large because no size limit exists for the signatures themselves. This allows a user with access to the BPF loader to specify an excessively large size value, forcing the kernel to perform expensive memory allocations via kmalloc_large or vmalloc. The resulting kernel memory consumption can exhaust available memory, trigger out‑of‑memory kills, or degrade system performance, effectively causing a denial of service. The vulnerability stems from unchecked allocation of large BPF signature buffers, exposing the kernel to uncontrolled memory usage.

All Linux kernel implementations before the application of the patch that limits BPF program signature size are susceptible. The vulnerability is vendor‑agnostic within the Linux ecosystem and applies to every kernel version lacking the commit that introduces the size restriction.

The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. No CVSS score is provided, but the nature of the bug—a lack of bounds checking that permits kernel memory exhaustion—indicates a high severity risk. Attackers can exploit this by injecting BPF programs with oversized signatures through standard user‑space interfaces, causing the kernel to allocate large memory blocks that may overwhelm system resources or lead to kernel crashes.