A malformed BTF descriptor can cause an overflow when calculating the number of expanded fields, which bypasses the capacity check performed by btf_parse_struct_metas(). The unchecked calculation allows the memcpy that copies repeated fields into a fixed‑size scratch array to write past the end of the array. This out‑of‑bounds write can corrupt kernel memory, potentially enabling an attacker who can load a BPF program to escape to higher privilege or crash the system.

The flaw resides in the Linux kernel’s BPF runtime. Any platform running a Linux kernel that accepts user‑supplied BTF data via the BPF_BTF_LOAD interface is potentially affected, regardless of vendor. The patch is applied at the kernel source level and will be included in future kernel releases; affected systems must update to a version that includes the btf_repeat_fields fix.

The EPSS score is reported as less than 1%, indicating a low probability of exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. However, the vulnerability provides a direct memory corruption path that could allow local privilege escalation if an attacker can supply crafted BTF data. The attack vector is inferred to be local, requiring the ability to load a BPF program with the BTF_BTF_LOAD command. Successful exploitation could lead to kernel memory corruption, privilege escalation, or system crash.