A flaw in the Linux kernel’s process-creation path allows a newly forked task’s bpf_storage pointer to remain uninitialized when the task is terminated before the pointer is set up. The kernel then attempts to free this bogus pointer. The resulting use‑after‑free can trigger a kernel panic, causing a denial of service. An attacker who can cause fork() from a process that has already been inserted into a task storage map can induce the kernel to hang, disrupting availability and potentially exposing other weaknesses if the crash can be leveraged further.

Linux kernel on all versions prior to the upstream patch that added explicit nulling of bpf_storage in copy_process. The vulnerability exists in the kernel’s bpf, fork, and task storage subsystems; the patch was introduced by commit 43f0005f81b8ce3be962d653cde8db9022f1e9b0 and subsequent related commits. Distribution kernel releases that have not yet applied these changes are affected.

The EPSS score is less than 1%, indicating a very low but nonzero exploitation probability, and the flaw is not listed in the CISA KEV catalog, so public exploitation data are unknown. The CVSS score of 7.8 reflects high severity for this use‑after‑free that can lead to a kernel panic. The likely attack vector is local: an attacker must be able to execute fork() on a process that has already been inserted into a task storage map, requiring same‑privilege execution as the target process.