The flaw originates from two 32‑bit specific bugs in the BPF bloom map allocation code. In the first, an integer wrap during the calculation of the bitmap size leads to an under‑allocation of the bloom filter, allowing subsequent writes to overflow the allocated object. In the second, the bloom hash is a u32, yet the bit‑setting routine interprets the value as a signed long; on 32‑bit x86 kernels, hashes in the upper half of the range become negative bit offsets, permitting reads or writes before the base of the bitmap. These conditions create out‑of‑bounds memory accesses that a process with CAP_BPF can exploit to execute arbitrary code with elevated privileges, resulting in local privilege escalation.

The vulnerability affects Linux kernel builds that support BPF on 32‑bit x86 architectures. No specific kernel releases are listed, so all current 32‑bit kernel configurations that compile the bpf bloom map are potentially impacted.

With a CVSS score of 6.7, this vulnerability is rated medium severity. The EPSS score of 0.00199 indicates a very low likelihood of exploitation. The vulnerability is not listed in CISA KEV. Despite the low exploitation probability, the known local privilege escalation vector remains significant for affected 32‑bit x86 kernels, so administrators should consider mitigations promptly.