The Linux kernel has an exposed BPF helper function named css_rstat_updated that accepts a caller‑provided CPU index without first validating that it corresponds to a real CPU core. When a BPF iterator or cgroup program supplies an out‑of‑range value such as 0x7FFFFFFF, the helper performs an out‑of‑bounds array lookup on the per‑CPU rstat structure. The kernel’s UBSAN detects the array‑index violation and forces a crash, resulting in a denial of service. This flaw is characterized by out‑of‑bounds array access (CWE-787).

Affected systems are any Linux kernel that implements the css_rstat_updated helper and allows BPF iterator or cgroup programs to run. It can be inferred from the absence of explicit kernel versions in the CVE that all unpatched kernels exposing this helper are susceptible. The vulnerability is only exploitable in environments where a user has the CAP_BPF and CAP_PERFMON capabilities, which are required.

The CVSS score of 7.8 classifies the flaw as high severity. The EPSS score of < 1% indicates a low probability of exploitation. An attacker with CAP_BPF and CAP_PERFMON can supply a malicious BPF program that triggers an out‑of‑bounds array lookup, causing the kernel to crash and forcing a reboot, which results in a denial of service for the affected host.