The vulnerability resides in the Linux kernel’s BPF verifier; the verifier’s is_branch_taken function incorrectly treats a comparison between a pointer and zero as always true for BPF_JMP32 instructions. A crafted eBPF program can thus execute branching logic that the verifier should have rejected, effectively bypassing safety checks and enabling arbitrary code to run in kernel context.

All Linux kernel versions that contain the unpatched BPF verifier are affected. Because the CVE does not specify a limited version range, every distribution shipping such kernels prior to the fix is considered vulnerable.

The CVSS score of 7 indicates medium severity, while the EPSS score of <1% and absence from KEV suggest that widespread exploitation has not been observed. Based on the description, it is inferred that exploitation requires the ability to load custom eBPF bytecode, so the attack vector is local or via a privileged user. The risk to systems permitting untrusted BPF code is therefore significant, though the overall exploitation probability remains low due to the local nature of the required privileges.