A flaw in the Linux kernel’s BPF subsystem causes the __get_user function to read user-supplied data without first verifying the pointer’s validity with access_ok. This allows a process to read beyond the intended bounds of a user-space buffer, thereby exposing arbitrary kernel memory to a requester that can supply specially crafted pointers, which is a high‑severity vulnerability rated 7.8 on the CVSS scale.

The vulnerability impacts the Linux kernel’s BPF module, specifically the uprobe_multi feature, in any kernel version that predates the commit adding the access_ok guard; vendors are Linux:Linux for both entries, and the advisory cites the patch via Git commit references.

The EPSS score of less than 1 % indicates a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that a local attacker who can inject or load BPF programs would be able to read confidential kernel data and potentially gain elevated privileges. Remote exploitation would require an additional vulnerability that enables remote injection of BPF bytecode, which is not documented in this advisory.