The Linux kernel BPF verifier contains a logic flaw when handling return values from LSM hooks. The verifier narrows a register to the expected signed 32‑bit range by intersecting the new bounds with any existing bounds in that register. Because the existing bounds are not reset before this intersection, a stale bound from a previous instruction can shrink the believed range to a value smaller than the real runtime value. Consequently, the verifier assumes it knows the register’s exact value while the actual return value may differ, creating a verifier/runtime mismatch that can be exploited to bypass BPF memory safety checks and potentially read or write arbitrary kernel memory from a BPF program.

All Linux kernels that include the vulnerable BPF verifier logic and LSM hook return handling. The CVE does not specify exact version ranges, so any kernel build that contains the described code path is potentially impacted, including modern kernels with BPF support for security modules.

The CVSS score of 8.8 indicates high severity, but the EPSS score of < 1% suggests a very low likelihood of exploitation at this time, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is inferred from the description: an attacker must be able to load a custom BPF program that interacts with an LSM hook return path, a privilege that typically requires local access or elevated privileges to execute kernel code. Based on the description, it is inferred that a local attacker who can compile and load BPF programs could trigger the flaw, allowing the verifier to underestimate bounds and thereby permit the program to perform out‑of‑bounds memory accesses inside the kernel. No public exploitation evidence is reported, but the potential for arbitrary memory read/write makes this a serious local privilege escalation risk if the attacker can control BPF code execution.