The kernel’s BPF subsystem tracks attached programs in an "effective" array, with an ordering rule that places programs marked BPF_F_PREORDER at the front. An earlier implementation used a linear walk of the program list to index into this array, but that walk no longer matches the actual array layout when such programs exist. Consequently, BPF program updates or deletions can overwrite a different array slot or incorrectly free a reference that is still in use, creating a use‑after‑free condition that corrupts memory and can be leveraged for privilege escalation or denial of service.

All Linux kernel releases that compile BPF support and implement the BPF_F_PREORDER flag are affected. The advisory does not list specific kernel versions, but the vulnerability existed until the repository commits referenced in the advisory performed the fix.

The CVSS score of 7.8 indicates a high severity, and the vulnerability is not listed in the CISA KEV catalog; however, the EPSS score of < 1% indicates a very low expected exploitation probability. The presence of a use‑after‑free indicates a moderate to high risk if an attacker can trigger the vulnerable code paths. Exploitation requires local interaction via BPF system calls such as bpf_link_update or bpf_prog_put, so the attack vector is local and depends on the ability to attach or modify BPF programs from an untrusted process.