A vulnerability in the Linux kernel on x86 platforms causes certain per‑CPU address loads, performed by BPF programs, to be encoded with an incorrect REX prefix. The destination register receives an unintended value, so the kernel attempts to dereference an address that was not properly converted to a per‑CPU pointer. This results in a page fault and a kernel panic, which manifests as a denial‑of‑service condition that crashes the whole system. The weakness is a null‑pointer/dereference error, identified as CWE‑476.

The flaw affects all Linux kernel implementations running on x86 hardware that have not yet applied the patch commits referenced in the advisory. Any such kernel, regardless of distribution or version, remains vulnerable until the kernel update is installed.

The CVSS score of 7.8 indicates a high severity level. The EPSS score is less than 1 %, suggesting a low probability of exploitation at the time of this analysis, and the flaw is not listed in CISA KEV. An attacker who can influence BPF program selection can trigger a kernel panic, causing a system‑wide denial of service. Based on the description, it is inferred that the exploit does not rely on external network input, and the attack vector appears local, requiring control over BPF program selection.