The vulnerability arises when a Linux kernel builds a device-bound-only BPF program while constant blinding is enabled. During JIT compilation the original program is cloned and freed, but the offload reference is not updated, leaving a dangling pointer. When the containing network namespace is torn down, the kernel dereferences this stale pointer, triggering a page fault that culminates in a kernel panic. This classic use‑after‑free flaw results in a denial‑of‑service without any immediate data exposure or code execution capability.

All Linux kernels that support device‑bound‑only BPF programs and constant blinding prior to the commit providing the patch are affected. The CAF does not list a specific version range, so any release before the fix should be considered vulnerable, including all mainstream distributions that ship the upstream Linux kernel in that state.

The CVSS score of 7.8 classifies this defect as high severity; the EPSS score is reported as less than 1 %, indicating a very low but nonzero exploit probability. The vulnerability is not in the CISA KEV catalog. Attackers need local kernel access to load a dev‑bound‑only BPF program with bpf_jit_harden set to 2, after which the flaw can be triggered by destroying the network namespace that hosts the program, resulting in a system‑wide crash.