The Linux kernel lacks a limit on the size of BPF program signatures, allowing an attacker who can load BPF programs to specify an arbitrarily large signature bound. When such a large signature is requested, the kernel allocates memory through kmalloc_large or vmalloc, which can consume significant kernel memory resources. The resulting allocation overhead can strain system memory, potentially degrading overall performance or triggering OOM conditions, thereby enabling a denial‑of‑service attack.

All Linux kernel releases prior to the commit that introduces the signature‑size cap are affected. The vulnerability is vendor‑agnostic within the Linux ecosystem and applies to any distribution packaging a kernel that lacks this limit enforcement.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score is not available, with no inclusion in the CISA KEV catalog. Attackers who have the ability to submit BPF programs to the kernel—typically users with BPF loading privileges—can trigger the oversized allocation path, potentially exhausting kernel memory or impeding normal operation. This risk does not require network exposure and can be exercised from local user space when BPF capabilities are granted.