The vulnerability occurs in the LoongArch port of the Linux kernel where the BPF Just‑In‑Time (JIT) compiler does not release the offset array associated with a compiled subprogram when the compilation of a subsequent subprogram fails. This missing cleanup results in a memory leak – a type of resource exhaustion weakness (CWE‑772). Over time repeated JIT compilation attempts that encounter errors will exhaust kernel memory, potentially destabilizing or crashing the system.

Linux kernel running on LoongArch CPUs. The vulnerability is present in any kernel version that implements the bpf_jit_free function without the recent patch. The affected source is the LoongArch BPF JIT code; no specific version numbers are listed in the advisories.

The EPSS score is less than 1 % and the issue is not listed in the CISA KEV catalog, indicating a low probability of exploitation in the wild. The likely vector involves the execution of BPF programs that trigger JIT compilation; an attacker or privileged process that can load BPF filters can provoke the failed compilation scenario. Although the flaw does not enable arbitrary code execution or privilege escalation, it can lead to gradual kernel memory depletion, slowing or crashing services if left unmitigated.