This vulnerability occurs in the Linux kernel’s traffic control classifier for BPF (cls_bpf). A user‑supplied BPF program bound to a specific network device is accepted without verifying that the device the program is attached to matches the device it was originally bound to. As a result, a program programmed for device A can be incorrectly attached to device B, and the subsequent deletion of device A can corrupt the offload state still in use on device B. The kernel then emits a WARN and may terminate with a panic if panic_on_warn is enabled, causing a system reboot. The primary impact is a denial‑of‑service via kernel crash; an attacker with the ability to load BPF programs could trigger it.

The flaw affects Linux kernels that contain the cls_bpf classifier before the patch referenced in the Git log. The failure exists across all kernel releases that use the legacy cls_bpf offloading path; no specific major or minor kernel version is listed, so any pre‑patch kernel running cls_bpf and attached to offloaded devices is potentially vulnerable.

The CVSS score is not provided, but the vulnerability can lead to a full kernel panic and is considered critical. The EPSS score is not available; the vulnerability is not listed in the CISA KEV catalog. The attack requires privileged execution to load and attach a BPF program, which is a local‑only or tightly scoped privilege. Although no public exploit is known, the lack of a device‑matching check means exploitation is relatively straightforward for an authenticated kernel developer or privileged user. Given the severity of a kernel panic and the likelihood that the vulnerability will be present on numerous systems, the risk is high until a kernel update is applied.