The vulnerability arises from missing .might_sleep on two kernel BPF helper prototypes, bpf_sys_bpf() and bpf_sys_close(). These helpers perform operations that can sleep, such as taking mutexes, allocating memory with GFP_KERNEL, or waiting for RCU grace periods. When a BPF program registers a timer callback, the verifier checks the callback in a non‑sleepable context but still allows the helper set. If the helper is invoked from a timer callback or other atomic region, the kernel attempts a scheduling operation while in an atomic context, causing a scheduling‑while‑atomic failure. This race can lead to kernel panics or loss of system stability, effectively a denial of service.

All Linux kernel implementations that have not incorporated the commit which added .might_sleep to the helper prototypes are affected. This includes all publicly released kernels prior to the inclusion of the fix. Vendor products that ship stock Linux kernels without the patch are susceptible. No specific version range is listed, so any kernel built from sources before the commit is considered vulnerable unless updated.

The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, indicating no confirmed public exploitation yet. Despite this, the flaw involves kernel‑level code and could be leveraged by an attacker capable of deploying a malicious BPF program that registers a timer callback, which is a privileged capability. The attack would require local access or compromised privileged process. If exploited, the result could be a kernel panic, memory corruption, or a reboot – all leading to denial of service. The missing attack vector is inferred from the commit context; thus the likely vector is local execution of a crafted BPF program.