A flaw in the Linux kernel’s BPF rbtree handling allows the comparator function to be executed while the tree’s root lock is held. The obstacle is that a static subprogram called from the comparator can unlock the tree, remove the node being compared, free its memory, and then re‑lock the tree. When the original insertion routine resumes, it operates on a stale parent pointer and links freed memory back into the tree. This re‑entrancy can corrupt kernel memory and, in the context of BPF program execution, may lead to code execution or other severe consequences. The text explicitly describes a use‑after‑free and a resulting memory corruption, but it does not confirm that arbitrary code execution is guaranteed, only that it "could" happen if the attacker takes advantage of the bug.

All Linux kernel builds that include the unpatched bpf_rbtree_add implementation are potentially affected. The specific range of kernel versions is not listed; any kernel that contains the vulnerable code before the accepted patch could be impacted. As the bug exists in the core BPF subsystem, it applies generally across distributions that ship the affected kernel source.

The CVSS score is 7.0 and the EPSS score is <1%, indicating a moderate severity with a very low estimated exploitation probability. The vulnerability is not listed in the CISA KEV catalog, so it has not yet been widely observed. Because the flaw involves a use‑after‑free within privileged kernel code, the potential impact remains high. The likely attack vector is a malicious BPF program; based on the description, it is inferred that an attacker would need privileged access. If exploited, kernel corruption could lead to privilege escalation or denial of service.