In the Linux kernel’s BPF subsystem, the helper function copy_user_syms reads a user‑supplied array of symbols using __get_user without first calling access_ok to verify that the memory range is readable. A malformed or malicious pointer supplied by a BPF program can cause the kernel to fault during the read, triggering an OOPS and terminating the system. This fault does not lead to privilege escalation or code execution but brings down the kernel, resulting in a denial‑of‑service.

The vulnerability exists in any Linux kernel build that lacks the commit adding the missing access_ok check to copy_user_syms. The affected code originates from the upstream Linux kernel tree; any distribution that releases a kernel before the patch will be affected unless it has backported the change. No specific vendor or version list is given, so the impact is on all installations running a vulnerable kernel revision.

No EPSS score is available and the issue is not listed in the CISA KEV catalog, indicating no confirmed active exploitation. The flaw is exploitable only by a local user capable of loading or executing a BPF program that can supply the offending pointer array. Once such code runs, the kernel will crash, causing a system‑wide denial of service. While the likelihood of widespread attacks is uncertain, the severity of a kernel crash makes the risk significant for environments where user processes can load BPF programs.