The Linux kernel’s BPF subsystem has a flaw in the handling of rhtab map entries when they are updated or deleted. The functions rhtab_map_update_existing() and rhtab_delete_elem() call bpf_obj_free_fields() to release resources, but when these operations are performed by BPF programs running in NMI context, freeing objects that reference kernel pointers or other complex fields can occur in an unsafe context. The likely attack vector is a privileged BPF program executed in NMI context, leading to memory corruption and potentially kernel crashes or denial of service. Based on the description, it is inferred that exploitation could result in kernel instability.

All Linux kernel builds that incorporate the rhtab map implementation before the patch commits 28fde1356dbc35e20a9f22a5ee65af09698fdf92 and 65cc95eba9e8b46312cac38c227473605a4b996a. The vendor identifier indicates Linux kernels as the affected product; no specific version numbers are listed, so any kernel version containing the vulnerable code prior to the patch is considered affected.

The CVSS score of 5.5 indicates moderate severity. The EPSS score of <1% suggests a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog, indicating no known publicly released exploits. The likely attack vector is a privileged BPF program executed in NMI context, and based on the description, it is inferred that exploitation requires privileged access to load BPF programs that trigger the unsafe cleanup.