The vulnerability occurs in the Linux kernel BPF subsystem where callback frame constructors clear the map_uid field, the only distinguishing attribute for inner maps that share the same template. When a timer callback is executed twice on different inner maps, the reclaimed map_uid makes the runtimes believe they refer to the same map. This allows a second timer to associate itself with a map that has already been freed, resulting in a dereference of a freed map instance. The defect could lead to memory corruption and potentially grant an attacker kernel‑level code execution or privilege escalation capabilities.

The flaw is present in the BPF component of the Linux kernel. While the exact kernel release numbers are not specified, any kernel that includes the described BPF map handling logic is potentially affected. System administrators should verify whether their deployed kernel version uses the unpatched BPF callback implementation.

The EPSS score is unavailable and the vulnerability is not listed in the CISA KEV catalog, so exploitation likelihood is unknown. Based on the description the attack vector would be local, requiring execution of a malicious BPF program that triggers the erroneous timer callback sequence. Because the flaw involves a use‑after‑free scenario, successful exploitation could lead to arbitrary code execution at kernel privilege, which is considered high severity. No CVSS score is provided, but the nature of the bug suggests it would likely rate severe if assessed.