The vulnerability involves an eBPF subsystem bug where the kernel fails to correctly preserve scalar register identifiers during linked‑register history synchronization. The snapshots used for branch evaluation are taken after a cleanup routine clears scalar identifiers that do not fit in the limited record. Consequently, back‑syncing of register ranges may adjust more registers than the propagation routine can handle, leaving stale or incorrect values in the eBPF program’s state. This mismanagement can result in incorrect kernel behavior due to inaccurate register handling during BPF program execution.

All Linux kernel releases that shipped the unpatched code are affected; the vulnerability is present in the core kernel irrespective of distribution or vendor, as it resides in the generic Linux eBPF implementation. No precise version range is specified, so any kernel prior to the patch that includes the buggy collect_linked_regs() implementation remains at risk.

The CVSS score of 5.5 indicates a moderate severity vulnerability, and the EPSS score of less than 1% reflects a very low probability of exploitation. The vulnerability is not listed in CISA's KEV catalog, suggesting no confirmed widespread exploitation. It remains a local‑access kernel‑level issue, triggered by an eBPF program with sufficient permissions. Attackers with privileged or kernel access could craft a custom BPF bytecode payload to trigger the faulty state propagation, potentially causing incorrect kernel behavior. Exploitation would require building a BPF program that exercises the bug and is likely restricted to environments where untrusted code regularly loads eBPF programs.