In the Linux kernel, the verifier for eBPF programs incorrectly handles failure paths for the ld_abs and ld_ind instructions within subprograms. When these load operations fail, the verifier no longer simulates the erroneous exit path, potentially allowing malicious BPF code to slip through verification and access or modify memory that should be protected. This flaw represents a failure to handle an error condition correctly and could lead to kernel memory corruption or privilege escalation if an attacker is able to inject a crafted BPF program.

Any Linux kernel instance running a version prior to the commit that introduced the fix (the patch referenced in the advisory) is susceptible. Because no specific version range is listed, all older kernel releases may be affected until the update is applied.

The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, so no active known exploits have been reported. However, the nature of the flaw suggests that an attacker who can load eBPF programs—such as a privileged user or a compromised application that can invoke bpf system calls—could potentially craft a subprogram that exploits the missing error path simulation to bypass security checks and gain kernel-level access. The exact likelihood of exploitation depends on the attacker's ability to inject BPF code; no public exploit code is known at this time.