The Linux kernel exposes a BPF helper, css_rstat_updated, that accepts a caller‑provided CPU index without checking whether it corresponds to a real CPU core. When a BPF iterator or cgroup program supplies an out‑of‑range value such as 0x7FFFFFFF, the helper performs an out‑of‑bounds array lookup on the per‑CPU rstat structure. The kernel’s UBSAN detects the array‑index violation and forces a crash, resulting in a denial of service. This flaw is characterized by an out‑of‑bounds array read (CWE‑125) and an integer comparison weakness (CWE‑129).

Affected systems are any Linux kernel that implements the css_rstat_updated helper and allows BPF iterator or cgroup programs to run. It can be inferred from the absence of explicit kernel versions in the CVE that all unpatched kernels exposing this helper are susceptible. The vulnerability is only exploitable in environments where a user has the CAP_BPF and CAP_PERFMON capabilities, which are required.

The CVSS score of 7.8 classifies the flaw as high severity. The EPSS score of < 1% indicates a low probability of exploitation. An attacker with CAP_BPF and CAP_PERFMON can supply a malicious BPF program that triggers an out‑of‑bounds array lookup (CWE‑125), causing the kernel to crash and resulting in a denial of service for the affected host.