The ARM64 BPF Just‑In‑Time compiler performs a range check on immediate values before encoding them into branch instructions. The current logic incorrectly allows values that exceed the signed N‑bit field, effectively permitting a signed (N+1)-bit range. When an out‑of‑range value passes this check, the encoder masks the sign bit, turning a forward branch into a backward one and corrupting control flow. This can cause incorrect program behavior or data corruption, though it does not directly provide arbitrary code execution.

All Linux kernel installations on ARM64 devices that include the BPF JIT feature and have not yet incorporated the patch identified by commit 1a113b5497297871699cd498b1b83542e0db7f15 (or later). This encompasses mainstream distributions, custom kernels, and any kernel that has not disabled or removed BPF JIT support.

The CVSS score is not published, and EPSS is not available, but the lack of a KEV listing indicates limited observed exploitation. The flaw requires the execution of BPF programs on the affected kernel, giving an attacker the ability to influence kernel-side control flow. While it does not immediately lead to privilege escalation or remote code execution, it can cause denial of service or serve as a stepping stone for more complex attacks in environments that run untrusted or complex BPF code. The risk is therefore considered high for such use cases.