The Linux kernel BPF subsystem contains a flaw where callback frame constructors clear the map_uid field of inner maps, causing distinct inner map templates to appear identical. This behavior leads to timers associated with a second inner map being improperly paired with a first map that has already been freed. The result is a use‑after‑free that could corrupt kernel memory or cause a crash. The weakness corresponds to CWE‑825, which concerns heap or memory corruption due to incorrect reference counting or pointer handling.

Any Linux system running a kernel that has not yet incorporated the patch for "bpf: Preserve inner map identity in callback frames" is potentially affected. All distributions shipping kernels with the original BPF callback logic are at risk. The advisory does not specify particular kernel releases, so administrators should confirm whether their running kernel contains the unpatched code. The affected product is the Linux kernel in general, with absence of version details in the advisory.

The CVSS score of 7.0 indicates high severity, while the EPSS score of less than 1% suggests a low probability of exploitation at this time. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is local access to load a malicious BPF program or otherwise invoke the vulnerable BPF logic; this inference is based on the description of timer callbacks and BPF program execution. An attacker with such access could trigger the use‑after‑free, potentially leading to kernel memory corruption, a crash, or privilege escalation. No publicly available exploitation code has been documented, but the low EPSS score does not preclude future development of an exploit.