The Linux kernel BPF subsystem has an flaw where an exclusive map—created with excl_prog_hash—is bound to a single program, preventing others from accessing it. The exclusivity check only applies to directly referenced maps (used_maps). A map reached via a map‑of‑maps is not examined, and the metadata comparison ignores the exclusivity hash. This enables a malicious BPF program to place an exclusive map inside a non‑exclusive outer map and later look it up or mutate it through a map‑of‑maps path, thereby bypassing the intended isolation guarantees and corrupting kernel data structures that rely on the exclusive map.

The vulnerability exists in the Linux kernel’s BPF implementation and affects all builds that compile the BPF subsystem and support map‑of‑maps. No specific version range is supplied, so any kernel before the patch commit (c/3a0f73d27a8d379a8852a378b3c3208143e3b3b2, c/7c58ace08f180f8e249e714d1623388362f9d807, or c/9a3c3c49c333760c8944dadacbe114c1884546ef) is at risk.

The CVSS score is 7.1, and the EPSS score is <1%, indicating a low probability of exploitation but a high potential impact. Based on the description, the likely attack vector is a local process with elevated privileges that can coerce the kernel into loading a malicious BPF program or manipulating map‑of‑maps. Because the flaw bypasses an explicit exclusivity guarantee, a privileged attacker could gain control over kernel memory associated with the exclusive map. The vulnerability is not listed in CISA KEV, so no publicly known exploits are recorded, but the high potential impact warrants immediate attention.