The flaw arises because regsafe() mapping fails to validate base ID consistency when BPF_ADD_CONST scalars are compared, which results in two different compiler states being considered equivalent. This oversight allows an attacker to craft a BPF program that passes verification but contains instructions that reference mismatched registers, potentially executing unintended kernel code. This is a logical validation error, effectively an element of CWE‑20 logic.

The vulnerability affects all Linux kernel versions that include the faulty verifier logic. No specific distribution or kernel release is listed, so any system running a kernel that lacks the patch is potentially impacted. Linux kernel devices that load eBPF programs (network packet filters, tracing tools, etc.) are the most relevant.

The CVSS score is not provided, and EPSS is not available, so the current exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed publicly exploitable instances. Attack requires a process with the ability to load a custom BPF program; therefore the likely vector is a local privileged user or a process with CAP_SYS_ADMIN. An unprivileged user is unlikely to be affected unless the system is misconfigured to allow untrusted BPF loading.