A flaw in the ARM hardware breakpoint handler in the Linux kernel permits the kernel to treat a breakpoint type 0x03 (ARM_ENTRY_CFI_BREAKPOINT) as an unhandled fault unless Control‑Flow Integrity (CFI) is actively used. The patched code removes the stub hw_breakpoint_cfi_handler, preventing it from stealing this breakpoint type. If the legacy stub remains, an attacker that can influence breakpoint settings may cause the kernel to incorrectly handle a fault, potentially leading to a denial of service or kernel panic. The underlying weakness is an improper restriction of operations within a privileged context.

All ARM‑based Linux kernel installations that include the legacy breakpoint handler and have not applied the commit that removed hw_breakpoint_cfi_handler are affected. The vulnerability is present in any kernel before the patch, regardless of version, so any server or device running an ARM variant of the Linux kernel compiled with the default configuration may be vulnerable until the kernel is updated.

The EPSS score is reported as less than 1% and the vulnerability has not been listed in CISA’s KEV catalog, indicating a very low probability of widespread exploitation. The absence of a published CVSS score limits precise severity measurement, but the flaw involves kernel fault handling rather than remote code execution. Based on the description, the likely attack vector is local privilege escalation or a kernel module that can set custom breakpoints; this conclusion is inferred from the vulnerability details. Therefore the overall risk can be considered low, yet the kernel‑critical nature of this area warrants review.