A helper in the Linux kernel’s BPF verifier incorrectly assumes that a pointer is non‑NULL based solely on its type. When user‑supplied BPF code performs pointer arithmetic with an unbounded offset, the resulting runtime pointer can still become NULL. The verifier then treats that pointer as a valid non‑NULL value and permits a subsequent dereference, triggering a kernel null pointer dereference that crashes the host and causes a denial‑of‑service. The flaw is a classic null‑pointer dereference condition, identified as CWE‑476.

All Linux kernel distributions that include the unpatched BPF verifier logic are affected. Any kernel that has not applied the commit enforcing bounded offsets for pointer arithmetic in o‑BPF programs remains vulnerable.

Exploitation requires a user‑space process to load a custom BPF program containing pointer arithmetic with an unbounded offset. The CVSS score of 5.5 indicates moderate severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog, and no public exploits are known. Loading a malicious BPF program can lead to a kernel crash, providing denial‑of‑service but not privilege escalation.