The flaw occurs when the Linux kernel is compiled with the legacy configuration option CONFIG_CFI_CLANG instead of the newer, compiler‑agnostic CONFIG_CFI. This mismatch causes the compiler to omit code that implements CFI checks for the btf_dtor_kfunc_t functions, effectively disabling that layer of protection. As a result, attackers may be able to exploit control‑flow hijack techniques that CFI normally prevents.

All Linux kernel builds produced before the commit that renamed CONFIG_CFI_CLANG to CONFIG_CFI are affected. This includes any distribution or custom kernel that used the old option name and has not been updated to the new configuration setting.

The publicly available CVSS score is missing, and an EPSS value is not supplied, so the exact severity cannot be determined from the data. The vulnerability is not listed in the CISA KEV catalog, indicating no known exploited instances. Nonetheless, the loss of CFI can allow arbitrary code execution if an attacker can trigger the affected BTF function pointers, which suggests a moderate risk for systems that rely on CFI for kernel integrity. The likely attack vector is local or requires a user‑land component that can influence kernel data structures.