The Linux kernel expose two BPF LSM hooks, bpf_lsm_task_to_inode() and bpf_lsm_inet_conn_established(), that are invoked from contexts that cannot safely sleep—rcu_read_lock() and softirq, respectively. Because the hooks are called in these non‑sleepable contexts, any BPF LSM program that relies on them in sleepable contexts will misbehave. The CVE description does not state a specific failure such as a crash, but misbehaviour could lead to incorrect policy enforcement or policy drops, undermining the intended security controls of BPF LSM.

All Linux kernel releases that include the pre‑patch bpf_lsm_task_to_inode() and bpf_lsm_inet_conn_established() hooks are affected. The CVE does not specify exact kernel version ranges, so any kernel version prior to the upstream patch that still implements these hooks in the described contexts is potentially vulnerable. System administrators should consult distribution‑specific advisories for more precise guidance.

The CVSS score of 8.8 classifies the issue as high severity, but the very low EPSS of less than 1% indicates a low probability of exploitation. The vulnerability is not listed in CISA KEV, implying no known exploits in the wild. The likely attack vector is local and requires privileges sufficient to load or manipulate BPF LSM programs, typically root or CAP_SYS_ADMIN. Since the vulnerability centers on misuse of the hooks, exploitation would require an attacker able to deploy malicious BPF LSM code rather than a broader remote attack.