The vulnerability arises when a privileged program passes a pointer as the nr_loops argument to the bpf_loop eBPF helper. The verifier mistakenly treats the pointer as a scalar, leading to a backtracking misuse warning that compiles into a kernel panic on systems with panic_on_warn enabled. The result is an abrupt system crash, effectively denying service. This flaw is a classic case of improper input validation, allowing an attacker to trigger a crash by supplying an unexpected data type.

The flaw is present in the Linux kernel, affecting all kernel releases that do not contain the commit that introduces ARG_SCALAR enforcement for bpf_loop. Specific affected versions are not listed; any kernel compiled before the fix is potentially vulnerable. Modern kernels from mainstream distributions now include the patch, but older or custom builds may still be impacted.

The CVSS score of 5.5 indicates moderate severity. The EPSS score of < 1% suggests a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The issue remains locally exploitable by code running with elevated privileges (e.g., CAP_SYS_ADMIN) that can load eBPF programs. Based on the description, it is inferred that the attacker needs local privileges to trigger the vulnerability. When exploited, the kernel will panic, causing a denial of service to the affected host. Because the attack vector requires local code execution, the threat surface is limited to privileged users or compromised applications that can inject eBPF programs.