In Linux kernels that support reuseport BPF programs, a race condition allows a reuseport cBPF program to be freed prematurely by sk_reuseport_prog_free() before an RCU grace period has elapsed. This use‑after‑free (CWE‑416) corrupts kernel memory and can be triggered by a local user manipulating BPF filters on a UDP socket while traffic is in flight, leading to arbitrary data corruption and potentially enabling privilege escalation or denial of service.

The flaw affects all Linux kernel releases that expose reuseport BPF program handling and have not yet merged the patch that defers freeing until after an RCU grace period. Exact affected versions are not specified in the advisory; users should verify whether the relevant commit is present in their kernel.

No CVSS score is published and the EPSS probability is not available; the vulnerability is not listed in the CISA KEV catalog. The attack requires local-access and the ability to configure reuseport BPF programs, but a race between replacement of the program and packet transmission can trigger the use‑after‑free. Given that the flaw can corrupt kernel memory, exploitation could lead to privilege escalation if the attacker can influence memory contents. No public exploits exist, but the potential severity warrants prompt mitigation.