The Linux kernel BPF subsystem did not correctly mark the faultable stack helpers bpf_get_stack() and bpf_get_task_stack() as sleepable. These helpers can trigger filesystem reads during build‑ID resolution, which may block if the filesystem is slow or unavailable. Because the prototypes lacked the may_sleep flag, the verifier could permit their use from non‑sleepable contexts such as RCU or preemption‑disabled regions. The likely effect is that the kernel could hang or become unresponsive when such a helper is invoked from a non‑sleepable context, resulting in a denial of service for the entire system.

All Linux kernel releases prior to the application of the relevant patch commit are affected. The vulnerability is present in the core Linux kernel itself; no specific distribution version is enumerated, so any running system with an unpatched kernel that includes the vulnerable helper prototypes is at risk.

Exploitation requires that an attacker be able to load a BPF program that calls the affected helpers from a non‑sleepable region, such as a preemption‑disabled or RCU context. This typically demands elevated privileges, for example root or an entity with the ability to load privileged eBPF programs. The vulnerability is therefore not remotely exploitable by unprivileged users, but it can be leveraged by attackers who compromise the kernel. The EPSS score is not available and the vulnerability is not listed in CISA's KEV catalogue. The CVSS score was not supplied in the data, but the nature of the flaw—causing kernel blocking and a full system denial of service—implies at least medium to high severity for a privileged attacker.