The Linux kernel omitted an IBPB flush when allocating memory for BPF Just‑In‑Time programs, which creates a speculative execution window that could be exploited by a Spectre‑v2 side‑channel attack to read data from reused JIT memory. This weakness is categorized as CWE‑515. The patch now issues an IBPB flush on each BPF JIT allocation unless a retpoline sequence is already in use, closing the speculative window and preventing the intended leakage.

All Linux kernel builds that enable CONFIG_BPF_JIT without incorporating the commit adding the IBPB flush are potentially vulnerable. The CVE data does not specify fixed versions; therefore any distribution running such kernels, regardless of version, can be impacted.

The EPSS score is less than 1 %, indicating that practical exploitation is considered unlikely in the wild. The vulnerability is not listed in CISA KEV. An attacker would need to be able to load BPF JIT programs, which typically requires local or privileged access; this requirement is inferred from the fact that BPF JIT is a privileged kernel feature, not directly stated in the description. Because the patch eliminates the speculative window, the overall risk has been substantially reduced.