A missing check in the Linux kernel’s cls_bpf classifier allows a device‑bound BPF program intended for one network interface to be attached to a different interface. When the original interface is removed, the offloaded program’s state is still linked to the new interface, which can trigger a kernel warning and, if panic_on_warn is enabled, cause a kernel panic. This flaw is related to incomplete verification (CWE‑346).

All Linux kernel releases that support cls_bpf offloading and have not yet applied the patch in commit 120977e2c0 are impacted. The vulnerability applies to Linux:Linux products across all versions lacking this fix.

The CVSS score of 7.8 indicates high severity, while the EPSS score of less than 1% suggests a very low exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. Attack requires privileged access to load and attach a BPF program, which is likely a local attacker with root privileges; this inference is based on the need to install BPF programs. If exploited, the system can be forced into a kernel panic, resulting in a denial of service.