In the Linux kernel, map values for BPF programs were freed by calling bpf_obj_free_fields() during updates or deletions. That cleanup could invoke destructors that are not safe when executed in Non‑Maskable Interrupt contexts, potentially leading to unsafe memory operations or kernel corruption. The commit introduces bpf_obj_cancel_fields() which limits destructive cleanup to NMI‑safe operations for specific fields and defers full destruction to a later, safer path, thereby mitigating the unsafe destructor calls. Programs that relied on immediate map slot clearance after updates or deletes may need to be adjusted because the eager‑free semantics are relaxed.

All Linux kernels that have not yet incorporated the bpf_obj_cancel_fields() commit are vulnerable. This includes every Linux distribution whose kernel version predates the changes introduced by commit 9ea734e2cc0143d7429ab7dc0b20c85e5836183c and commit a3a81d247651218e47153f2d2afd7aee236726fd. Users of standard distributions such as Ubuntu, Debian, Red Hat, Fedora, and others running those pre‑patch kernels are affected.

The CVSS score of 7.8 indicates medium to high severity, but the EPSS score of less than 1 % and its absence from the CISA KEV catalog suggest that exploitation is currently unlikely. An attacker who can load privileged BPF programs could manipulate map update or delete operations in a context that triggers the unsafe cleanup, potentially causing kernel memory corruption or privilege escalation. The likely attack vector is the execution of a crafted BPF program that performs map updates or deletions, inferred because the vulnerability is located in privileged kernel code that processes BPF map operations.