A flaw in the Linux kernel’s BPF rbtree handling allows the comparator function to be executed while the tree’s root lock is held. The obstacle is that a static subprogram called from the comparator can unlock the tree, remove the node being compared, free its memory, and then re‑lock the tree. When the original insertion routine resumes, it operates on a stale parent pointer and links freed memory back into the tree. This re‑entrancy can corrupt kernel memory and, in the context of BPF program execution, may lead to code execution or other severe consequences. The text explicitly describes a use‑after‑free and a resulting memory corruption, but it does not confirm that arbitrary code execution is guaranteed, only that it "could" happen if the attacker takes advantage of the bug.

All Linux kernel builds that include the unpatched bpf_rbtree_add implementation are potentially affected. The specific range of kernel versions is not listed; any kernel that contains the vulnerable code before the accepted patch could be impacted. As the bug exists in the core BPF subsystem, it applies generally across distributions that ship the affected kernel source.

The CVSS score is not available and the EPSS score is not provided, which does not indicate a low risk. The vulnerability is not listed in the CISA KEV catalog, so it has not yet been seen as a widely exploited case. However, because the flaw is a use‑after‑free that occurs inside privileged kernel code, it has a high potential impact. The likely attack vector is the injection of a malicious BPF program; based on the description, it is inferred that an attacker would need privileged access to load such a program. If exploitation occurs, the kernel could be corrupted, leading to privilege escalation or denial of service.