Technical impact
The flaw is a use‑after‑free in the Linux kernel’s BPF subsystem. When a BPF program deletes a map element it can retain a pointer to the freed value and use that pointer to arm a timer. If the freed unit is recycled before the registered destructor runs, a nulling operation clears the timer pointer, and the callback later executes with its key and value pointing into deallocated memory, potentially causing memory corruption or a crash. The vulnerability is tied to improper memory management (CWE‑825).
Affected Systems
All Linux kernel releases that contain the BPF rhtab_map_update_elem implementation before the commit that fixed this issue are affected. The impact spans the Linux kernel product broadly. No specific affected versions are listed in the available data, so any release prior to the fix may be at risk.
Risk and Exploitability
The vulnerability can be exploited by an attacker who can load custom BPF code with kernel privileges, typically only a privileged user or a compromised system. The CVSS score of 5.5 indicates moderate severity. The EPSS score is <1% and the issue is not listed in CISA’s KEV catalog, suggesting a low probability of exploitation, but the potential impact of a kernel use‑after‑free remains significant.
