The vulnerability arises in the Linux kernel bpf subsystem when a buffer allocated by kvzalloc or vmalloc is freed with kfree. This violates the memory allocation contract and can corrupt kernel memory. In a reproduced scenario, a large write to /proc/sys/kernel/domainname triggered an Oops during a page fault. An attacker who can invoke the same sysctl write path could potentially crash the kernel or leverage the memory corruption to elevate privileges. The exact extent of privilege escalation is not described in the input, so we infer that a corrupted kernel pointer could lead to elevated privileges if the attacker controls memory layout.

All Linux kernel versions that contain the buggy bpf sysctl handling logic, from the v6.13-rc1 line through v7.1-rc5. The bug is present in any kernel that has not yet applied the patch that replaces kfree with kvfree. Specific version numbers beyond this range are not listed in the input, so all builds in the mentioned range are affected.

The CVSS score is 7.8, indicating a high severity vulnerability. The EPSS score is less than 1 percent, implying a low likelihood of exploitation. The vulnerability is not in the CISA KEV catalog. Exploitation requires performing an oversized sysctl write from a task inside a cgroup; this usually requires privileged access or compromised cgroup control. Because such access is normally limited, real- world attacks would need additional privileges. Given the low EPSS score and the specific prerequisite of cgroup controls, overall risk remains moderate despite the high CVSS, but the potential impact is serious if exploited.