The vulnerability arises when the per‑VMA lock is held across the execution of a BPF program, creating a lock ordering problem with helpers that depend on mmap_lock. This ordering (vm_lock → i_rwsem → mmap_lock → vm_lock) can lead to deadlock or inconsistent access to kernel data structures. The verifier trusts only the vm_mm and vm_file pointers, which are protected, but other pointers are left untrusted and may be copied, meaning that the bug could allow a kernel crash or denial of service if an attacker can execute specially crafted BPF code. No remote code execution or privilege escalation is described, but a local practitioner could potentially trigger instability by loading malicious BPF programs.

Linux kernel, all versions prior to the fix contained in the patch referenced in the advisory. No specific release numbers are listed, so all kernels running before the update are considered affected.

The CVSS score is not provided and the EPSS score is unavailable, indicating no quantitative assessment of risk. The vulnerability does not appear in CISA’s KEV catalog. The attack vector is inferred to be local; an attacker would need to run privileged or trusted BPF programs to exploit the lock ordering violation. Because no active exploitation reports are available, the risk is largely theoretical, though a kernel panic or denial of service could result if the issue is triggered in a production environment.