The Linux kernel failed to mark the faultable variants of bpf_get_stack() and bpf_get_task_stack() as sleepable, allowing these helpers to block on filesystem reads even when called from non‑sleepable contexts such as RCU or timer callbacks. When a malicious BPF program invokes these helpers from such a region, the verifier permits the call, and the kernel can stall while performing a blocking operation, ultimately leading to a system hang or unresponsiveness. The primary impact is a denial of service at the kernel level, affecting availability for the entire system.

All Linux kernel builds prior to the commit that introduced the sleepable flag for the faultable stack helpers are subject to this issue. Since the vulnerability resides in core kernel BPF code, any distribution that ships an unpatched kernel—including Ubuntu, Debian, Fedora, Red Hat, CentOS, and Arch Linux—is potentially affected, whereas kernels that contain the patch are immune.

The CVSS score of 5.5 indicates moderate loss of availability. EPSS shows a probability of exploitation of less than 1 %, suggesting a very low likelihood of being targeted. The vulnerability is not currently listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker must be able to load and execute a BPF program, which typically requires privileged access such as root or CAP_BPF; such a requirement is not spelled out explicitly in the advisory. The likely attack vector involves executing a crafted BPF program from a user or application that can load eBPF code into the kernel.