Technical impact
check_cond_jmp_op() in the Linux kernel BPF verifier mistakenly treats a comparison of a nullable pointer against the zero register as a proper null check. The verifier then promotes the pointer to non‑null status while leaving the zero register imprecise, allowing a BPF program to pass verification with an invalid null pointer. At runtime, when the lookup returns NULL the program continues on the non‑null branch and dereferences a pointer that is zero, potentially causing a kernel crash or data corruption.
Affected Systems
The flaw affects the generic Linux kernel across all distributions in any version prior to the commit that added precise handling for the zero register. No specific version range is provided in the advisory, so an unpatched kernel is in scope. All releases that use the default BPF verifier path are susceptible.
Risk and Exploitability
The EPSS score indicates a very low exploitation probability (<1%). The CVSS score of 5.5 denotes a medium severity. The vulnerability is not listed in the CISA KEV catalog. It permits privilege escalation or denial of service if an attacker can load a crafted BPF program. The likely attack vector is a user or compromised process with the ability to submit eBPF code to the kernel. An attacker could trigger a null dereference by forcing a failed map lookup to be treated as non‑null, thus potentially crashing the kernel or bypassing isolation.
