The vulnerability originates from an integer overflow in the Linux kernel BPF subsystem where an overflowing sum of two unsigned 32-bit values is used to calculate memory allocation size, leading to an undersized buffer that is then over‑copied with memcpy. This causes an out‑of‑bounds write that can corrupt kernel memory and result in a kernel panic, providing a denial of service. The weakness is a classic integer overflow (CWE‑190) leading to a buffer overflow and also a write‑after‑allocation vulnerability (CWE‑787). Based on the description, it is inferred that the attacker must supply a BPF program that triggers the copy fallback path, as the len is sourced from BPF with ARG_ANYTHING.

All Linux kernel implementations are affected until the kernel includes the overflow check added to bpf_msg_push_data(). The problem exists in any kernel that has not been patched with the commit adding the check. The references point to kernel commits that implement the safeguard, indicating the fix is part of the upstream Linux kernel tree rather than a vendor‑specific variant.

The CVSS score for this vulnerability is 8.4, indicating high severity. Its EPSS score is less than 1%, suggesting a very low but nonzero likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog, so there is no evidence of widespread exploitation yet. An attacker would need to supply a BPF program that triggers the copy fallback path, which can be done via socket sendto or similar system calls. This suggests a local or potentially remote exploitation path depending on the ability to load malicious BPF code. This vulnerability exploits an integer overflow (CWE‑190) leading to an out‑of‑bounds write (CWE‑787), and the critical impact of a kernel panic gives this flaw high intrinsic risk, but its exploitation complexity may be moderate because it relies on injecting a crafted len value through a BPF program.