The vulnerability occurs when a BPF program uses a bpf_map_elem iterator to bind to an exclusive map. The kernel performs an exclusivity check only when a map is referenced directly from a BPF program, but the iterator binds the map at attachment time and never triggers this check. Consequently, the exclusive map remains accessible and its values are exposed as a writable buffer, allowing an attacker to overwrite kernel memory and potentially gain higher privileges.

All Linux kernel builds that implement the bpf_map_elem iterator without enforcing the exclusivity check are affected. Specific version information is not provided, so any current kernel version running the default BPF subsystem may be vulnerable.

The flaw provides a path to modify kernel memory from user‑space via a BPF program, which can lead to privilege escalation. Exploitation requires the attacker to load a BPF program that attaches a bpf_map_elem iterator to an exclusive map. The CVSS score is 5.5, the EPSS score is <1%, and the vulnerability is not listed in the CISA KEV catalog; the moderate severity indicates a moderate level of risk. The attack vector is inferred to be local user space to kernel interaction through the BPF subsystem.