In the Linux kernel, the bpf_get_fsverity_digest helper suffers from a race condition that leads to kernel crashes. This flaw is a CWE-663 weakness, where the implementation incorrectly assumes that the contents of a dynptr are stable during concurrent modifications. An attacker can craft a BPF program that invokes the helper, causing the kernel to read a corrupted digest size and ultimately leading to a denial of service.

All releases of the Linux kernel that include the buggy bpf_get_fsverity_digest implementation before the patch commit are affected. The advisory does not list specific kernel versions, but any kernel version released prior to the inclusion of the fix may be vulnerable. The flaw resides in the core Linux kernel.

The EPSS score is below 1% and the vulnerability is not listed in CISA’s KEV catalog, indicating no widespread exploitation yet. The CVSS score of 7.8 reflects a high severity. The likely attack vector is a local user who can load a BPF program that invokes the helper, implying a privilege or trusted user context rather than remote exploitation. In environments where arbitrary BPF programs are permitted, exploitation can trigger a kernel crash, causing a denial of service.