The flaw arises when the bpf_msg_pop_data helper adds two 32‑bit values, start and len, and stores the result in a 64‑bit variable without casting. The addition wraps at 32‑bit, so the later bounds check can accept an out‑of‑range start/len combination. This allows the pop loop to read beyond the end of the scatter‑list, ultimately triggering a general protection fault and kernel panic. No elevation of privileges is mentioned; the impact is purely an availability failure due to a kernel crash.

Linux kernel versions that do not yet contain the commit series that introduces a 64‑bit cast in the addition and tightens the bounds check are affected. The patch appears in the referenced commit series (e.g., 17eb9832a10db2f7a80cb429ca2bc5038445a943). All users running a vulnerable kernel should verify whether their system includes these changes.

Based on the description, it is inferred that an attacker would need the ability to execute a BPF program that utilizes sockmap to trigger the vulnerability. The integer overflow occurs during a bounds check in bpf_msg_pop_data(), allowing an out‑of‑range start/len pair that causes the pop loop to read beyond the end of the scatterlist, culminating in a general protection fault and kernel panic. The available data does not explicitly state the required privilege level; therefore, we cannot conclusively determine whether local or remote execution is necessary. The EPSS score of < 1 % indicates a very low probability of exploitation, the CVSS score of 8.4 reflects high severity, and the vulnerability is not listed in CISA’s KEV catalog. The most likely attack vector involves sending malformed data to a BPF program running in a privileged context on the host, which would lead to an availability loss by crashing the kernel.