The BPF compiler in the Linux kernel failed to apply a mandatory zero‑extension after a 32‑bit compare‑and‑swap (cmpxchg) operation. This oversight means stale high‑order bytes can remain in kernel registers when the operation succeeds, violating BPF semantics that require each 32‑bit register operation to be zero‑extended. The resulting stale data can corrupt kernel memory during atomic updates, which is a core memory corruption flaw and is mapped to CWE‑681.

All Linux kernel versions that include the BPF subsystem before the commit that introduced the zero‑extension fix are affected. This includes 64‑bit deployments on x86‑64 and ARM64 architectures where 32‑bit cmpxchg requires explicit zero‑extension. Any distribution shipping such kernels without the patch, including older or backported releases, remains vulnerable.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score of <1% suggests a very low real‑world exploitation probability. The vulnerability is not listed in CISA KEV. Based on the description, it is inferred that an attacker must have the ability to load a custom BPF program, which is typically limited to privileged users or kernel module operations. Even though exploitation is difficult, a successful exploit could enable kernel memory corruption, leading to privilege escalation or denial of service.