The vulnerability originates from an integer overflow in the Linux kernel BPF subsystem where an overflowing sum of two unsigned 32-bit values is used to calculate memory allocation size, leading to an undersized buffer that is then over‑copied with memcpy. This causes an out‑of‑bounds write that can corrupt kernel memory and result in a kernel panic, providing a denial of service. The weakness is a classic integer‑overflow leading to a buffer overflow and also a write‑after‑allocation vulnerability (CWE‑787). Based on the description, it is inferred that the attacker must supply a BPF program that triggers the copy fallback path, as the len is sourced from BPF with ARG_ANYTHING.

All Linux kernel implementations are affected until the kernel includes the overflow check added to bpf_msg_push_data(). The problem exists in any kernel that has not been patched with the commit adding the check. The references point to kernel commits that implement the safeguard, indicating the fix is part of the upstream Linux kernel tree rather than a vendor‑specific variant.

The CVSS score is 8.4, and the EPSS score is less than 1%, indicating a very low but nonzero likelihood of exploitation. The vulnerability is not listed in CISA KEV, suggesting no known widespread exploitation yet. An attacker would need to supply a BPF program that triggers the copy fallback path, which can be done via socket sendto or similar system calls. This suggests a local or potentially remote exploitation path depending on the ability to load malicious BPF code. The critical impact of a kernel panic gives this flaw high intrinsic risk, but its exploitation complexity may be moderate because it relies on the ability to inject a crafted len value through a BPF program.