An out‑of‑bounds write occurs when the kernel processes a BPF_PROG_QUERY request. The kernel writes the "query.revision" field back to userspace without verifying that the supplied attribute structure is large enough. If an attacker passes a smaller structure, the kernel writes beyond the provided buffer, corrupting memory. Depending on the memory region overwritten, this flaw can allow an attacker to execute arbitrary code in the kernel, leading to privilege escalation or denial of service.

The vulnerability affects any Linux kernel that implements the BPF_PROG_QUERY interface before the patch is applied, regardless of the distribution vendor. The affected code paths involve both the generic BPF query handling and the cgroup attach type query handlers. Since the patch was merged into the mainline kernel, all releases older than the commit that introduced the fix are potentially impacted.

The CVSS score of 7.8 classifies the vulnerability as High severity. The EPSS score is less than 1%, indicating a very low but nonzero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, so no known public exploits have been reported to date. The flaw allows an out‑of‑bounds write to kernel memory, which, if successfully targeted, could enable an attacker to execute arbitrary code in the kernel, leading to privilege escalation. The attack likely requires local code execution to craft a custom BPF program with an undersized attribute structure, but could also be achieved through a container or unprivileged process that interacts with the BPF subsystem. Given the lack of public exploits, the risk remains significant for systems that have not yet applied the kernel fix.