The vulnerability occurs when a kernel BPF program that is bound only to a network device is compiled with constant blinding enabled. The compilation process clones the program and frees the original, but the offload structure is not updated to point to the surviving clone. When the kernel cleans up the network namespace, the stale pointer is dereferenced, causing a page fault and kernel panic. This results in a denial of service for the affected system. The weakness is a classic use‑after‑free flaw.

All supported Linux kernels that compile BPF programs with constant blinding before the patch are affected. The issue is present in any kernel prior to the commit that introduces the correction described in this advisory. No specific version range is listed, so all releases prior to that commit should be considered vulnerable.

The CVSS score is not provided, but the absence of an entry in the CISA KEV list suggests no known exploitation in the wild yet. The EPSS score is unavailable, so the likelihood of exploitation cannot be quantified. The attack vector is local: an attacker who can load a dev‑bound‑only BPF program into a network namespace with bpf_jit_harden set to 2 can trigger the flaw, forcing the kernel to panic when the namespace is destroyed. As the flaw involves a use‑after‑free that leads to a kernel crash, its impact is limited to denial of service rather than remote code execution.