The Linux kernel contains a race condition in the BPF subsystem where the zap_pages() function fails to hold the required mmap_lock while touching user memory. This oversight allows concurrent modifications to memory management structures that may result in memory corruption, kernel panics, or denial of service. The vulnerability is tied to improper synchronization and can compromise the integrity of the kernel’s address space allocator.

The flaw affects all Linux kernel releases that contain the buggy implementation of the BPF zap_pages() routine. No specific vendor or version list is provided in the advisory, so any distribution that ships the unpatched kernel is potentially vulnerable until a later release incorporates the fix.

The CVSS score is 7.8, indicating a high severity of the vulnerability. The EPSS score is < 1%, suggesting a low to moderate likelihood of exploitation in the current environment. The vulnerability is not listed in CISA KEV, indicating no publicly known exploitation. Exploitation would likely require local or higher privilege and knowledge of memory layout to trigger a fault, but the race condition could be abused by an attacker with code execution privileges to destabilize services or crash the system.