The flaw occurs in the Linux kernel’s BPF sockmap implementation during data insertion into a scatterlist entry. When a fragment is split, the code incorrectly advances the right fragment offset, leading to an inconsistent split layout. This miscalculation can corrupt kernel memory locations, which could potentially be exploited for privilege escalation if an attacker can trigger the fault through crafted BPF programs. The potential is inferred rather than directly stated in the documentation.

The vulnerability affects Linux kernel versions that contain the buggy bpf_msg_push_data implementation. All Linux kernel releases containing the affected code are at risk. No specific vendor or distribution names are given.

The CVSS score of 8.4 indicates high severity, and the EPSS score of less than 1% shows that exploitation is currently unlikely. The description notes that the bug can corrupt kernel memory; if an attacker can trigger the fault—potentially through crafted BPF programs—there is a potential for elevated privileges, which is inferred. The vulnerability is not listed in CISA KEV, suggesting that publicly known exploits have not yet appeared. No specific attack vector or proof of exploitation is disclosed.