The Linux kernel’s BPF verifier contains a flaw where nullable arguments in helper calls, such as bpf_register_is_null(), are not marked as precise. This oversight causes the verifier to prune execution paths based on an arbitrary scalar value, potentially allowing a crafted BPF program to influence kernel control flow. The same issue exists for bpf_get_local_storage() calls that enforce a zero second parameter but fail to mark the scalar precise. The weakness is a form of information misuse leading to incorrect path pruning, identified as CWE‑1025.

All Linux kernel versions that have not incorporated the recent patch are affected. The issue resides in core verifier code, so any distribution shipping an unpatched kernel is vulnerable until the update is applied or the component is upstreamed. Vendors that provide kernels after the fix should have incorporated the patch in the kernel source base.

With a CVSS score of 5.5 and an EPSS score lower than 1%, the overall risk is moderate. The flaw is not listed in CISA’s KEV catalog, indicating no confirmed widespread exploitation. Likely exploitation requires the attacker to load a malicious BPF program, a capability typically restricted to privileged users or system processes. If such a program can manipulate the verifier’s pruning logic, it could trigger kernel code paths that lead to elevated privileges or a denial‑of‑service condition.