The Linux kernel BPF verifier contains a flaw that allows an attacker to write arbitrary data into a kernel pointer field when a register that is not proven precise contains the value zero. This occurs because check_map_kptr_access() accepts a zero register as valid but does not mark it precise, permitting a later overwrite with a non‑zero scalar. The attacker can thus inject attacker‑controlled bits into internal kernel structures, including the PTR_TO_BTF_ID type, potentially compromising kernel data integrity.

Linux kernel builds prior to the patch that introduced mark_chain_precision() are affected. Distribution kernels that have not incorporated this verifier fix are vulnerable, regardless of the exact release version. Exact impacted versions are not specified in the advisory.

Based on the description, it is inferred that the likely attack vector is loading a malicious BPF program, which normally requires elevated privileges such as CAP_SYS_ADMIN or root. No public exploit has been reported, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is < 1%, and the CVSS score is 7.0, indicating high severity. Exploitation would enable kernel memory manipulation.