The vulnerability occurs when the scatter‑list copy bitmap is not kept in sync with buffer transformations in the Linux kernel’s sk_msg subsystem. When a scatter‑list entry backed by a non‑private page cache page is moved, split, or compacted without updating its sg.copy flag, the entry can be exposed as writable to BPF programs. A malicious BPF helper can then overwrite the original page cache, enabling arbitrary modification of kernel memory. This flaw is a classic case of Improper Authorization (CWE‑279) and can lead to Remote Code Execution.

All Linux kernel deployments that include the unpatched sk_msg scatter‑list handling logic. The bug is present in every released kernel until the commit that introduced the fix; therefore any system running a kernel built from a tree older than the patch is potentially vulnerable.

The flaw carries a CVSS score of 9.4, classifying it as a very high‑severity issue, and an EPSS score of <1 %, indicating that, at the time of assessment, the likelihood of exploitation is very low. Attackers would need the ability to load user‑controlled BPF programs, which typically requires elevated privileges or exploitation of another vulnerability that grants BPF access; therefore the primary attack vector inferred is local privilege escalation via a malicious BPF helper. The vulnerability is not catalogued in the CISA KEV list.