An error in the Linux kernel's BPF compiler prevents the fastcall rewrite logic from correctly handling instruction sequences that are broken by a jump. The function mark_fastcall_pattern_for_call() fails to flag instructions that are the target of a jump, leading bpf_remove_fastcall_spills_fills() to rewrite an incomplete series of spill‑call‑fill instructions. When a malicious BPF program is compiled with this flaw, the rewritten program can execute unintended kernel instructions, providing an avenue for kernel‑level code execution. Based on the description, it is inferred that an attacker would need to supply a crafted BPF program that triggers the faulty rewrite path, which could arise in contexts such as BPF‑based network filtering or eBPF programs run in privileged mode.

Affected systems are any Linux kernel releases that include the obsolete BPF fastcall rewrite code before commit 0b1c83dc3c4401cd7e846548f62e3caf3d06742e (or the equivalent patch 24adbc2c3bbe3385ce922587e1f8e837a68b3e25). All distributions that ship the Linux kernel in this state, irrespective of edition, are vulnerable. No specific distribution or customer version is listed; the vulnerability is tied to the kernel source itself.

The CVSS score is 7.0, indicating significant impact when exploited. The EPSS score of < 1% signals a low probability of exploitation at the current time. The vulnerability is not present in the CISA KEV catalog, with no known large‑scale exploitation. Based on the description, it is inferred that exploitation would require a malicious user to load a BPF program that triggers the flawed rewrite, suggesting that privileged contexts or kernel‑deployed BPF usage are preconditions for an attack. While the flaw is remotely exploitable in theory, the practical attack surface is limited to environments that allow custom eBPF programs to run in the kernel.