The vulnerability resides in the Linux kernel’s BPF subsystem, where uprobe programs that are allowed to write to the BPF program context (kprobe_write_ctx) can be abused by a freplace program. A freplace BPF program can change values in the kernel register structure (struct pt_regs). Because the kernel function invoked through kprobe will use the modified registers, attackers can force the first argument of any kernel function to a value of their choosing, including zero. This allows manipulation of kernel function arguments and potentially arbitrary kernel‑mode code execution or privilege escalation.

The affected product is the Linux kernel across all vendors that ship Linux. No specific kernel version range is listed, indicating the issue exists wherever this combination of kprobe and freplace BPF functionality is present.

Exploit probability data is currently unavailable and the vulnerability is not listed in the CISA KEV catalog, but the impact is severe because the flaw enables modification of kernel execution context. The attack vector is inferred to be local; it requires the ability to load BPF programs, which typically requires root or CAP_SYS_ADMIN privileges. Once an attacker can load a malicious BPF freplace program that targets a kprobe, they can alter kernel registers and potentially gain kernel-level privilege escalation. The patch removes the ability to bind freplace programs to kprobe programs with mismatched kprobe_write_ctx values, thereby eliminating the abused code path.