The BPF compiler in the Linux kernel failed to apply a mandatory zero‑extension after a 32‑bit compare‑and‑swap operation, violating the BPF specification. The missing zero‑extension allows stale high‑order bytes to remain in kernel registers, which can corrupt kernel state during atomic updates. An attacker with the ability to load a custom BPF program can exploit this flaw to manipulate kernel data, potentially escalating privileges or disrupting kernel operation.

All Linux kernels that contain the BPF subsystem before the commit that introduces the zero‑extension fix are affected. This includes kernels running on 64‑bit architectures such as x86‑64 and arm64, where 32‑bit cmpxchg requires explicit zero‑extension. Any distribution shipping such kernels without the patch, including older or backported releases, is at risk.

No CVSS score is publicly available and the vulnerability is not listed in CISA KEV, so the precise risk remains unclear. However, because the flaw can lead to kernel memory corruption, exploitation could enable privilege escalation or denial of service. The attack requires the capability to load BPF bytecode, which is normally confined to privileged users, reducing the likelihood of exploitation in standard production environments but still warranting timely remediation.