The vulnerability is a race condition in the Linux kernel’s reuseport BPF program handling. When a BPF filter on a UDP socket that uses SO_REUSEPORT is replaced while another thread is sending traffic, the kernel may free the old cBPF program before the RCU grace period has completed. This triggers a use‑after‑free that results in an out‑of‑bounds read that corrupts kernel memory, potentially leading to kernel crashes or memory corruption.

Linux kernel users who have not yet incorporated the patch that defers freeing of reuseport cBPF programs after the RCU grace period are affected. The vulnerability applies to Linux kernel releases up to and including 7.1 release candidates (e.g., 7.1rc1 and 7.1rc2). Admins should verify whether the relevant commit is present in their kernel tree.

The CVSS score of 7.8 reflects high severity, and the EPSS score of <1 % suggests a very low exploitation likelihood currently. The flaw is not catalogued in CISA KEV. Exploitation requires local access where an attacker can configure and replace reuseport BPF programs on a UDP socket while traffic is being processed, creating a race condition that causes a use‑after‑free (CWE‑416) and an out‑of‑bounds read (CWE‑125), with additional implicit improper synchronization (CWE‑364). No public exploits exist, yet kernel memory corruption could lead to crashes or privilege escalation, making timely patching critical.