The vulnerability originates from an incomplete check within the Linux kernel’s BPF subsystem. The check that validates a program’s compatibility with the cgroup local storage cookie incorrectly treats a program that has no cgroup storage as compatible with any storage cookie. This defect permits a storage‑less BPF program to appear as a legitimate intermediary in a tail‑call chain that links an entry program to a program that expects to run within a cgroup storage context. Because the kernel later executes the callee in the caller’s cgroup context, the chain can cross contexts in a way that was not intended. The flaw thus enables the execution of a BPF program under a cgroup layout that does not match its declared state, potentially breaking isolation guarantees.

The weakness is present in any Linux kernel prior to the inclusion of commit abad3d0bad72. It is not vendor‑specific; every distribution shipping a kernel version that lacks this commit is affected. The vulnerability affects the core BPF subsystem and the handling of program arrays and does not involve user‑space configuration or third‑party modules.

The vendor’s CVSS score of 7.8 indicates substantial impact; the very low EPSS score (<1%) suggests that exploitation is not common yet. The vulnerability is not listed in the CISA KEV catalog, implying no publicly known exploits. Based on the description, it is inferred that an attacker would need the ability to load or replace BPF programs—typically via privilege escalation or local access—to exploit the logic error and execute BPF code in a cgroup context different from its intended one. The exploit would rely on tail‑call chaining across storage states, a restricted operation that the kernel mistakenly permits.