The vulnerability is a use‑after‑free flaw in the Linux kernel’s BPF subsystem. When a BPF program deletes a map element, it may keep a pointer to the freed value and use that pointer to arm a timer. If the freed unit is recycled from the memory cache, the destructor clears the timer pointer, so a later callback runs with the key and value pointing into deallocated memory, potentially allowing arbitrary code execution or a crash.

All Linux kernel releases that include the BPF rhtab_map_update_elem implementation prior to the commit that fixed this issue are affected. The flaw exists in the kernel’s map handling for BPF programs and applies to the Linux kernel product in general, regardless of vendor distribution.

The bug can be exploited by an attacker able to load custom BPF code with kernel privileges, which is typically possible only by a privileged user or compromised system. No public exploit is known and the advisory lists the issue as resolved, but the potential impact of a use‑after‑free in kernel code is high. Because the EPSS score is unavailable and the vulnerability is not listed in CISA’s KEV catalog, the precise likelihood of exploitation is uncertain, though the severity of the flaw suggests caution.