The vulnerability occurs when the scatter‑list copy bitmap is not kept in sync with buffer transformations in the Linux kernel’s sk_msg subsystem. When a scatter‑list entry backed by a non‑private page cache page is moved, split, or compacted without updating its sg.copy flag, the entry can be exposed as writable to BPF programs. A malicious BPF helper can then overwrite the original page cache, granting an attacker the ability to modify kernel memory. This flaw involves an Access Control weakness and can lead to local privilege escalation. The issue is rooted in incorrect handling of the sg.copy bitmap during sk_msg operations.

All Linux kernel deployments that include the unpatched sk_msg scatter‑list handling logic. The vulnerability is present in every released kernel until the commit that introduced the fix; therefore any system running a kernel tree older than that patch is potentially vulnerable.

The flaw carries a CVSS score of 9.4, classifying it as a very high‑severity issue, and an EPSS score of <1 %, indicating that, at the time of assessment, the likelihood of exploitation is very low. Attackers would need the ability to load user‑controlled BPF programs, which typically requires elevated privileges or exploitation of another vulnerability that grants BPF access; therefore the primary attack vector inferred is local privilege escalation via a malicious BPF helper. The vulnerability is not catalogued in the CISA KEV list.