The vulnerability lies in the Linux kernel’s handling of BPF linkage for io_uring operations. A second registration of an already‑bound ops map succeeds because the kernel does not reject re‑registration when the ops->priv field is already set. This allows the new registration to overwrite the private reference, orphaning the original io_uring context. The orphaned context remains in memory while its loop_step pointer still references an executable trampoline that is freed when the map is removed. A subsequent io_uring_enter call from the orphaned ring triggers a use‑after‑free, executing stale code. The memory area is reachable by any task that holds the CAP_BPF and CAP_PERFMON capabilities, which means a privileged user can trigger the flaw. This use-after-free flaw aligns with CWE-825.

This issue affects the Linux operating system, specifically the Linux kernel. No specific kernel version or patch level was identified in the available data, so any system that runs an unpatched kernel that includes the vulnerable bpf‑ops and io_uring implementation is potentially at risk.

The CVSS score for this vulnerability is 7.8, and the EPSS score is < 1%, indicating a low but non‑zero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, so no known active exploit is currently documented. The attack vector is local, requiring a process that can acquire CAP_BPF and CAP_PERFMON capabilities. An attacker with these capabilities can trigger the use‑after‑free and potentially execute arbitrary code, giving them kernel‑level privileges. Given the severity of a kernel‑level code execution and criticality of the capabilities involved, the risk to systems remains high as long as the kernel is unpatched.