ALU32 operations in the LoongArch BPF JIT produce a 32‑bit result and zero‑extend the upper 32 bits, but the JIT incorrectly sign‑extends the result of signed division and modulo. For a negative 32‑bit quotient or remainder, the JITed code leaves bits 63:32 set, whereas the BPF verifier and interpreter treat those bits as zero. The mismatch between the JIT behavior and the kernel’s expected semantics can cause BPF programs that rely on precise signed arithmetic to return unexpected values.

Linux kernel for the LoongArch architecture, any build that has BPF JIT enabled and was compiled before the commit that introduced the fix (716cb29). No specific kernel version ranges are provided in the advisory, so all unpatched LoongArch kernels are potentially vulnerable.

The CVSS score of 7.8 indicates high severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation. The vulnerability is not in CISA’s KEV catalog and no public exploit is known. The likely attack vector is an attacker who can load a malicious BPF program into the kernel, such as via an application that compiles BPF code. Based on the description, it is inferred that an incorrectly signed division result could lead to unpredictable BPF program behavior, which might be leveraged to subvert security checks if such checks depend on exact arithmetic results. However, the impact remains theoretical in the absence of documented exploitation.