The Linux kernel BPF verifier mistakenly accepts a constant negative offset when calculating buffer pointer accesses. Because the verifier only checked the instruction offset, a pointer arithmetic that produced a signed negative value would bypass the bounds check entirely. Consequently, the verifier would treat the negative start as the buffer’s end, which wraps around and allows the BPF program to load and attach without increasing the maximum allowable tracepoint access.

All Linux kernel releases prior to commit 022ac0750883 are affected. The flaw exists in every kernel variant that does not contain the patch that moves constant pointer offsets to reg->var_off and adds a check for negative offsets. Systems that enable raw tracepoints and allow BPF programs to use PTR_TO_TP_BUFFER or PTR_TO_BUF accesses are impacted regardless of distribution or custom kernel build.

No CVSS score is provided and the EPSS score is not available; the vulnerability is not listed in CISA KEV. The flaw relies on the ability to load a BPF program, which typically requires write access to the BPF filesystem and is generally available to users with sufficient privileges. If such a user can craft a program that triggers the negative offset flaw, the program would execute in kernel mode and could potentially perform out‑of‑bounds memory accesses, leading to corruption of kernel data structures. Because the vulnerability is not automatically mitigated beyond the patch, the risk remains significant until the kernel is updated or mitigated by restricting BPF loading or disabling raw tracepoints.