The vulnerability resides in the Linux kernel’s BPF subsystem. During the end of an RCU read‑side critical section a kernel pointer (kptr) that should be treated as untrusted is still considered a live allocated object. The type_is_ptr_alloc_obj() function therefore allows the pointer to satisfy the bpf_refcount_acquire() checks, even when it is NULL or points to memory that has already been freed. Consequently a BPF helper (kfunc) can dereference a stale or null pointer, causing kernel memory corruption, which can be leveraged to gain elevated privileges or crash the system.

All supported Linux kernel releases that contain the unpatched logic are affected. The issue was resolved in the upstream repository in a commit referenced in the advisory, and the kernel version that introduced the fix is after commit 6b1f786ad85a0b63393b76f5e634deab1a73198c. Administrators should verify that their distribution’s kernel, or any custom kernel they compile, incorporates this patch. No particular distribution or version was singled out in the advisory, so the default recommendation is to apply the latest kernel update from the vendor.

The vulnerability has a severe effect on confidentiality, integrity, and availability because it leads to memory corruption in kernel mode. Although publicly available exploit code is not yet reported, the lack of a critical‑threshold EPSS score and absence from the KEV catalog suggest the risk is not yet widely exploited, yet the attack vector is local and requires the ability to inject a malicious BPF program, which is often granted to privileged users or applications. The potential for privilege escalation makes this a high‑severity CVE, and the kernel community considers it a critical issue.