In the Linux kernel BPF subsystem a bug in freeing a red‑black tree root caused stale node pointers to remain attached to surviving objects. If such an object survives a drop it still holds an owner reference to the freed root and the old tree linkage. When a new root object reuses the same address, removal operations can incorrectly pass the owner check and delete a node belonging to the old tree, potentially leading to memory corruption or arbitrary code execution. This weakness represents a use‑after‑free scenario that can lead to memory corruption or arbitrary code execution.

All Linux kernel builds that implement the BPF red‑black tree feature are affected. No specific release versions are identified in public advisory, so any system running an unpatched kernel that includes the BPF rbtree code is potentially vulnerable.

The CVSS score is 7.8, EPSS score <1%, and it is not listed in the CISA KEV catalog. The impact remains serious: a malicious party could trigger the vulnerable bpf_rb_root_free path by delivering a crafted BPF program, potentially leading to kernel memory corruption and privilege escalation or denial of service. Exploitability appears limited to systems that run vulnerable kernel versions and have BPF enabled, which reduces the immediacy of a broad attack.