In the Linux kernel's BPF subsystem, an ARRAY_OF_MAPS can be created with a template inner map marked BPF_F_INNER_MAP. When an outer map lookup succeeds, the verifier incorrectly represents the inner map pointer with the template, causing it to elide nullness checks and rely on the template's max_entries. If the concrete inner map has a smaller max_entries, an out-of-bounds memory access can occur inside the kernel, corrupting memory or triggering a crash. The vulnerability is a bounds-checking failure (CWE-787) that allows kernel memory corruption or a denial of service.

All Linux kernel variants that include the unpatched BPF implementation are potentially affected. The CNA data does not specify any particular kernel release, so any distribution whose kernel contains the vulnerable ARRAY_OF_MAPS code is susceptible. Users who deploy custom or third-party BPF programs on their hosts are at risk.

The EPSS score of less than 1 % indicates that exploitation is very unlikely at present, and the vulnerability is not listed in the CISA KEV catalog. The CVSS score of 5.5 classifies it as Moderate severity, so the risk is modest, but a successful exploit could cause a kernel crash or memory corruption. The attack vector is inferred: an attacker would need the ability to load a malicious BPF program, which typically requires privileged or local access. Remote exploitation would require an additional vector to inject BPF code. No reported incidents exist, so the likelihood remains low despite the serious impact if the flaw were abused.