In Linux kernel BPF sock_ops programs, when the destination and source registers are the same, the macros SOCK_OPS_GET_SK() and SOCK_OPS_GET_FIELD() incorrectly leave the destination register unchanged after a failed full socket check. This stale ctx pointer can be treated as a socket pointer and exploited for a stack-out-of-bounds access, or it can be exposed to the verifier as a scalar value, leaking a kernel address. The vulnerability allows an attacker who can inject BPF programs to obtain kernel memory pointers and potentially cause memory corruption or privilege escalation.

All Linux kernel versions before the patch commit 10f86a2a5c91fc4c4d001960f1c21abe52545ef6 and 18e3ffde1822f0b48b1753bf34aa97ce839df1d8 are impacted; users should apply any kernel updates that incorporate these patches.

The CVSS score is not provided, and EPSS is unavailable, so the exploitation probability cannot be quantified precisely. The vulnerability is not listed in CISA KEV. Exploitation requires the ability to load BPF sock_ops programs, meaning the attacker must have sufficient privileges (CAP_SYS_ADMIN or equivalent). Therefore the risk is moderate: trusted users could exploit the flaw, but it is not trivially available to an unauthenticated attacker.