A privileged user may create a BPF_MAP_TYPE_INODE_STORAGE map while the BPF LSM framework has not been correctly initialized. The missing initialization leaves a security blob offset at a default value, causing a dereference of a NULL pointer during map cleanup. This results in a kernel panic, producing an immediate denial of service. The weakness stems from improper initialization and null‑pointer dereference of kernel data structures.

All Linux kernel builds where CONFIG_BPF_LSM is enabled and the BPF LSM is not booted via the lsm= parameter. The flaw is present in any kernel version that compiles BPF_MAP_TYPE_INODE_STORAGE without the defensive flag. The specific kernel releases affected are not enumerated in the advisory.

The CVSS score is 7.0, indicating high severity, and the EPSS score is less than 1%, reflecting a very low current exploitation probability. The vulnerability is not listed in CISA KEV, suggesting limited public exploitation data. The vulnerability requires local privileged access to load a malicious BPF program that creates the offending map type. Because it triggers a kernel panic rather than privilege escalation or data exfiltration, it is primarily a denial‑of‑service attack. In practice, exploitation would involve a malicious user or process with e‑uid 0 creating a BPF map and then forcing cleanup or inode destruction to trigger the crash.