An out‑of‑bounds read occurs in the Linux kernel when a BPF map of type CGROUP_STORAGE with a value size not rounded to 8 bytes is copied into a per‑CPU map of the same size. The kernel routine pcpu_init_value assumes source values are 8‑byte aligned and copies 8 bytes, causing a read beyond the source buffer. This allows an attacker to read unintended kernel memory, potentially exposing sensitive information or destabilizing the kernel.

All Linux kernel releases that expose the BPF interface for CGROUP_STORAGE and per‑CPU maps before the patch are affected. The vulnerability is present in kernel commits prior to the fix referenced by the provided commit URLs, which include stable releases up to at least the 6.x series.

The CVSS score is not provided; EPSS is unavailable, and the issue is not listed in CISA KEV. However, the nature of the out‑of‑bounds read suggests a high risk of information disclosure. The attack requires the ability to create and manipulate BPF maps, typically available to a user with limited privileges. Once the specific map combination exists, an OOB read occurs during copy_map_value_long, and there are no mitigations other than applying the patch.