The vulnerability occurs in the Linux kernel BPF subsystem, where the bpf_fd_array_map_clear function neglects to yield the CPU during a loop that clears entries from a PROG_ARRAY map. Especially for maps containing many elements, the loop invokes a resource‑intensive operation for each entry, which can cause the RCU subsystem to stall under load. The stall manifests as a delay in RCU callbacks and can leave the system unresponsive, effectively creating a denial‑of‑service condition. This deficiency aligns with the CWE‑400 Resource Exhaustion weakness, as the kernel fails to give up the CPU during an extended operation, exhausting system resources.

The flaw affects the Linux operating system kernel in all releases that include the bpf_fd_array_map_clear function and were released before the patch that adds cond_resched. The bug was observed in kernel 6.14.0-13195-g967e8def1100, but the fix applies to any version that incorporates the commit series linked in the advisory references. Administrators should review their kernel version and consider a kernel upgrade to a release that includes the patch.

No CVSS score or EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog, implying no publicly known widespread exploits at the time of writing. However, because the bug can be triggered by clearing large BPF maps under heavy load, it poses a significant risk in environments with frequent BPF operations. The likely attack vector requires the ability to manipulate BPF maps – typically a privileged user or a process with elevated capabilities – but could be leveraged remotely if the application layer exposes BPF functionality to untrusted users. Therefore, the risk remains high for systems that execute frequent BPF clear operations and should be treated with priority.