The vulnerability lies in the BPF stack cleanup logic within the Linux kernel. When a high half of a STACK_SPILL slot becomes dead while the low half stays live, the cleanup routine clears the saved spilled_ptr metadata. For pointer spills this clearing bypasses the normal scalar register‑fill check, allowing a 32‑bit fill from the still‑live half to be interpreted as a scalar stack read. Since this behavior is governed by improper pointer metadata handling, it is categorized as CWE‑843. The result is that a malicious BPF program can read kernel memory it should not see or force a kernel crash, leading to potential information disclosure and instability.

Affected systems are Linux kernel builds that expose the bpf() system call. The advisory does not specify affected version numbers, so it is inferred that any kernel build prior to the commit that introduced the fix may contain this flaw unless the update has been applied. Users should assume kernels before the commit are potentially vulnerable if they have not installed the patch.

The flaw involves manipulation of kernel stack memory, which constitutes a high‑severity vector. The CVSS score of 8.4 highlights serious impact, while the EPSS score of < 1% indicates a very low likelihood of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. An attacker who can run a crafted eBPF program on the target system, which requires local or privileged access, could trigger the flaw to read protected kernel memory or destabilize the kernel. The likely attack vector is inferred to be a crafted BPF program that exploits the pointer spill cleanup bug, effectively bypassing the safety check to access out‑of‑bounds memory (CWE‑843) and potentially gaining unauthorized memory access. The overall risk remains significant for systems that allow untrusted BPF programs.