The kernel bug occurs when a bpf_sysctl_set_new_value helper replaces a pending sysctl value without appending a terminating NUL. This allows downstream parser code to read past the end of the supplied buffer, resulting in an out-of-bounds read and potential kernel panic or leak of kernel memory. The vulnerability does not directly grant code execution; it can affect system stability and confidentiality of sensitive kernel data.

Affected by the Linux kernel versions that lack the patch committing the missing NUL‑termination. The issue was demonstrated on a 7.1.0‑rc3 kernel, so any kernel built before the fix is potentially vulnerable. All distributions that ship this kernel without the subsequent update are at risk.

The CVSS score of 5.5 indicates moderate severity. The EPSS score of < 1% and its absence from the CISA KEV catalog suggest limited public exploitation to date. Nonetheless, the weakness can be triggered only when a privileged attacker installs a BPF program that writes to a sysctl. Successful exploitation would cause kernel memory corruption that could crash the system or leak data, so the risk is considerable for privileged users. No remote exploit is known and the vector is local or requires root or kernel capability to load the BPF program.