The Linux kernel NetSched cls_bpf module contains a flaw that allows an attacker to trigger unbounded recursion during offload rollback. When cls_bpf_offload_cmd() receives a failing tc_setup_cb_replace() call twice, it recurses on itself instead of performing a controlled rollback. The recursion eventually exhausts the kernel stack, causing a crash. This weakness falls under uncontrolled recursion leading to resource exhaustion.

All Linux kernel versions that include the vulnerable cls_bpf module and have not yet applied the commit that added the rollback protection. The flaw is present in any kernel that fails to incorporate the patch noted by commit identifiers 10753da2d659dd425a6e620f47f86852d604f67f and its subsequent merges.

With a CVSS score of 5.5, the vulnerability is considered medium severity but still poses a high risk due to kernel stack exhaustion. The EPSS score is less than 1%, indicating a low likelihood of exploitation. The issue is not listed in the CISA KEV catalog. The description does not explicitly state the attacker’s required capabilities; it is inferred that an attacker must be able to run code with sufficient privileges to inject BPF programs or modify traffic control settings in order to trigger the flaw, which could lead to local escalation or denial of service if the kernel crashes.