The Linux kernel’s BPF Just‑In‑Time compiler allocates many small programs into large executable memory regions and then reuses those regions as programs are loaded and freed. When fresh code is written into an area previously occupied by another program, an indirect jump into the new program can use a branch‑prediction entry that was cached for the old program. This stale prediction can mislead the CPU into taking a different execution path, effectively allowing an attacker to redirect kernel execution. The vulnerability is rooted in improper handling of branch‑prediction state during memory reuse. The impact is the potential to execute arbitrary code at kernel privilege after a successful JIT‑spraying attack.

All Linux kernel versions that expose the legacy BPF JIT allocator and do not have the hardening patch applied are affected. This includes mainstream distributions shipping the 6.x series kernels or older releases that still support legacy BPF JIT allocators. The patch that introduces branch‑predictor flushing is incorporated into mainline starting with commit 6e52c240c43a6; however, the actual activation depends on a static key 'bpf_arch_pred_flush_enabled', which must be enabled on architectures requiring a flush. Versions prior to this commit, or on systems where the key is left disabled, remain vulnerable.

The EPSS score is reported as < 1%, indicating the probability of observed exploitation is very low. The CVSS score of 7.0 reflects a moderate to high severity due to the potential for kernel code execution. Lack of inclusion in the CISA KEV catalog further suggests limited active exploitation. The attack requires knowledge of the kernel’s BPF JIT internals, the ability to craft a JIT‑spraying payload, and, in some cases, specific architectural support for branch‑predictor flushes. These conditions lower the likelihood of successful exploitation but the damage potential remains high if an attacker succeeds.