The vulnerability occurs in the Linux kernel's libbpf signed loader, where the loader verifies the hash of a BPF map only when the map is frozen. If the map is not exclusive, another BPF program can modify the map after this verification, causing the loader to base its decisions on stale data. This flaw enables an attacker who can control the host environment to alter map contents between verification and use, potentially leading to the execution of unintended code or corruption of program behavior. The weakness is rooted in a race condition in map validity checking and is classified as an integrity issue.

All Linux systems that use the kernel's libbpf API for loading signed BPF programs and that do not enforce exclusive maps for metadata are affected. The specific vendor names are Linux Kernel as provided by the CNA. No explicit impacted version range is given in the data; the fix is included in recent kernel patches referenced in the advisory links.

The CVSS score is not disclosed, and the EPSS score is not available, making it difficult to quantify current exploitation likelihood. However, because the flaw allows host‑level manipulation of kernel memory that can undermine signed BPF program integrity, the risk remains significant for environments where arbitrary kernel modules can load. The KEV status shows the vulnerability has not yet been listed in the KEV catalog. The likely attack vector is local or remote kernel module loading, where an attacker can supply a non‑exclusive metadata map to the signed loader.