In the Linux kernel, a kernel‑local vulnerability exists in the eBPF verifier. When bpf_check() allocates env->insn_aux_data but later fails to allocate env->succ, the control flow jumps directly to err_free_env, bypassing the intended vfree call. This omission leaves the auxiliary data allocated in kernel memory, creating a leak of potentially sensitive kernel information.

Any system running a Linux kernel that does not yet contain the fix introduced in commit 26490a375cb9be9bac96b5171610fd85ca6c2305 or d8df91756890de058646597367507b239a6d2025. All kernels released after those commits include the patch, so all earlier kernel versions are considered vulnerable.

The CVSS score of 5.5 identifies the flaw as medium severity, while the EPSS score of less than 1% signals a low probability of exploitation. Based on the description, it is inferred that the attacker must load malformed BPF programs, which typically demands elevated privileges. A successful exploitation can read leaked kernel memory, compromising confidentiality but it is unlikely to provide remote code execution. The vulnerability is not listed in the CISA KEV catalog.