A flaw in the Linux kernel’s BPF verifier incorrectly models legacy packet‑load instructions when they are executed from callbacks. The verifier treats the load as if it returned a value, sets the return register to zero, and subsequently flags an unexpected register state. The parser then emits a warning and causes the privileged BPF program loader to fail with an -EFAULT error. The weakness is an improper input validation: legacy instructions are allowed in the source but are disallowed in the verifier context, which leads to erroneous verification behaviour.

All Linux kernel releases prior to the patch commit are affected, and the issue is present on every architecture that supports eBPF. Any system running an unpatched kernel is a potential target, and only privileged BPF loaders can trigger the failure.

The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, indicating no publicly known exploitation attempts. The CVSS score is not provided. Exploitation requires a privileged BPF program loader; it therefore poses a denial‑of‑service risk to networking or kernel functionality rather than arbitrary code execution. The likely attack vector is a privileged user or service that can load BPF programs, which is typically constrained to system administrators or specialized services. Without such privileges, the vulnerability remains infeasible to exploit.