This vulnerability in the Linux kernel bpf subsystem arises when the removal of an RCU delay on inode freeing allows a concurrent unlink operation to drop the last reference to an inode while the inode is still being accessed by an RCU pathwalk. The result is a use‑after‑free of the inode structure, which can corrupt kernel memory. The flaw is a classic memory‑corruption defect that may enable privilege escalation if an attacker can trigger the race condition via BPF map manipulation or similar local code execution.

All systems running an upstream Linux kernel version that contains the vulnerable bpf implementation, before the commit that restores the RCU delay on inode freeing, are affected. This includes any kernel where the bpf and bpffs paths are enabled and the affected commit (4f375ade6aa9) is not yet applied.

The CVSS score of 7.8 signifies a high severity vulnerability. The EPSS score of <1% indicates a very low but nonzero probability of exploitation in the wild. The vulnerability is not listed in CISA KEV. Exploitation would require a local user or process that can manipulate BPF maps and trigger the race condition, but once achieved it could corrupt kernel memory and result in privilege escalation.