A bug in the Linux kernel’s FineIBT implementation misreads a hash value used by the Control Flow Integrity subsystem. The offset used in cfi_get_func_hash() does not match the new FineIBT preamble layout, so BPF JIT‑compiled stub functions compute an incorrect hash. When the kernel enforces the FineIBT check, the mismatch causes a CFI failure, which results in a kernel panic and an immediate denial of service.

All Linux kernel builds compiled with CONFIG_FINEIBT enabled are affected. This includes distribution kernels that provide FineIBT support. Any system running a kernel with the faulty configuration can be impacted, regardless of vendor or distribution.

An attacker who can load a BPF program or otherwise trigger the BPF JIT path may be able to cause the kernel to crash. The EPSS score is not available, the vulnerability is not listed in CISA KEV, and no CVSS score is supplied. The attack requires local or privileged execution to invoke BPF JIT, so the exploitability is limited to scenarios where the attacker can run BPF code within the kernel context. Once triggered, the resulting kernel panic is non‑recoverable without a reboot, resulting in a denial of service for the affected host.