The kernel BPF interpreter incorrectly handles the BPF_MOV64_PERCPU_REG instruction, ignoring the offset that normally lets the JIT compiler adjust the per‑CPU base. When the interpreter falls back on this instruction, it attempts to read from an invalid address, triggers a page fault inside the kernel, and ultimately causes an Oops. The result is a kernel crash that can be leveraged to deny service to the affected host.

All Linux kernel deployments that have not yet incorporated the patch that sets jit_required to true for programs containing BPF_ADDR_PERCPU insn are affected. The vulnerability applies to the Linux kernel as a whole, regardless of hardware platform, and is not tied to any specific vendor-supplied kernel variant.

Because the CVSS score is 5.5 and the EPSS score is < 1%, the quantitative risk assessment indicates a moderate threat likelihood but a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, indicating no known large‑scale exploitation campaigns. Based on the description, it is inferred that an attacker who can inject or load a BPF program containing BPF_ADDR_PERCPU instructions could trigger the interpreter fallback and provoke a kernel crash. The likely attack vector appears to involve the execution of privileged BPF bytecode, which may be available locally or remotely depending on the system configuration. The impact is local denial of service until the host is rebooted or the kernel is patched.