This vulnerability arises from a bounds‑checking failure in the Linux kernel BPF subsystem. When an ARRAY_OF_MAPS uses a BPF_F_INNER_MAP template, the verifier mistakenly records the inner map pointer as the template, causing nullness check to rely on the template’s max_entries. If a lookup key lies outside the template bounds but inside the runtime inner map’s bounds, the verifier can erroneously eliminate necessary bounds validation, potentially allowing out‑of‑bounds memory access within kernel space. This error can trigger a kernel crash, leading to a denial of service, or corrupt memory in a way that might expose sensitive data. Because the vulnerability requires a crafted BPF program that performs an inner map lookup, its exploitation would normally be confined to environments where a user can load BPF code with sufficient privileges. An attacker would need to generate or inject a malicious BPF program that targets the kernel’s BPF verifier, leveraging the mismatch between template and runtime map bounds. The flaw does not directly enable arbitrary code execution, but the resultant corruption or crash can provide a foothold for further compromise. In the field, exploitation is expected to be limited due to the specialized nature of the attack and the need for privileged map operations. Any system that allows untrusted or compromised users to load BPF programs is at risk, especially if the kernel is still running a version that has not incorporated the fix.

All Linux kernels that ship unpatched versions are potentially affected. The CNA list does not specify particular kernel releases, so any distribution whose kernel incorporates the vulnerable BPF code without the corresponding patch is susceptible.

The EPSS score is below 1 %, indicating a very low likelihood of observed exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers would need local or privileged access to load BPF programs that exploit the bounds‑checking failure; remote exploitation would require an additional vector to inject malicious BPF code. Given the specialized prerequisites, the immediate risk is limited, but the impact of a successful exploitation would be severe, resulting in a kernel crash or memory corruption that could lead to data leakage or denial of service.