A bug in the Linux kernel’s FineIBT implementation misreads a hash value used by the Control Flow Integrity subsystem. The offset used in cfi_get_func_hash() does not match the new FineIBT preamble layout, so BPF JIT‑compiled stub functions compute an incorrect hash. When the kernel enforces the FineIBT check, the mismatch causes a CFI failure, which results in a kernel panic and an immediate denial of service.

All Linux kernel builds compiled with CONFIG_FINEIBT enabled are affected. This includes distribution kernels that provide FineIBT support. Any system running a kernel with the faulty configuration can be impacted, regardless of vendor or distribution.

An attacker who can load a BPF program or otherwise trigger the BPF JIT path may be able to cause the kernel to crash. The CVSS score of 5.5 indicates a moderate severity, and the EPSS score is less than 1%, suggesting a low probability of exploitation in the wild. The vulnerability is not listed in CISA KEV, and the exploit requires local or privileged execution to invoke BPF JIT, so the attack surface is limited to scenarios where the attacker can run BPF code within the kernel context. Once triggered, the resulting kernel panic is non‑recoverable without a reboot, resulting in a denial of service for the affected host. It is inferred that an attacker would need to load BPF code to trigger the BPF JIT for exploitation, as this is not explicitly stated in the CVE description.