Based on the description, bpf_refcount_acquire() incorrectly interprets a borrowed RCU‑protected pointer as an owning reference, returning a non‑NULL value even when the reference count has reached zero. The mismatch suggests that a BPF program could mistakenly believe it holds a valid kernel object while the object might have already been freed, potentially leading to use‑after‑free scenario that could expose privileged data or compromise kernel integrity. The weakness is a NULL pointer dereference (CWE‑476).

The vulnerability affects every Linux kernel build that predates the patch introducing the nullable refcount acquire behavior (git commit 85074498228a2500ea8b8039c49cc1ab8ad5328f). All vendors shipping unpatched kernels, irrespective of distribution, are exposed; specific distributions are not listed, so users should verify whether their kernel includes this commit.

The CVSS score of 5.5 reflects a moderate impact, and an EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not included in the CISA KEV catalog. Based on the description, exploitation would require an attacker to load a malicious BPF program that performs reference‑counting logic, a capability typically reserved for privileged users. Thus, in environments that allow arbitrary user‑supplied BPF loading, a trusted adversary might potentially abuse the dangling pointer for privilege escalation or denial of service.