A flaw in the BPF subsystem of the Linux kernel allows an unvalidated node_id to be passed to arena_alloc_pages(), enabling an out‑of‑range numeric value that can corrupt kernel memory or improperly address NUMA nodes. The weakness functions as a numeric out‑of‑range input validation failure (CWE‑20). An attacker with the ability to load BPF programs could trigger the bug to crash the kernel, cause a denial of service, or leverage the corrupted state to execute code at elevated privilege.

The issue is present in any Linux kernel release that has not incorporated the node_id bounds‑checking patch. Distribution kernels prior to the official fix subscribe to this vulnerability because the patch has not yet been backported to their version series.

The assigned CVSS score of 7.8 indicates a high severity flaw. The EPSS score of less than 1% reflects a very low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog, suggesting no publicly known widespread exploitation. The likely attack vector is a local process that can load BPF programs, which typically requires elevated privileges, though kernel configuration and system privileges may affect reachability.