The vulnerability is caused by a missing .might_sleep flag on two BPF helper prototypes, bpf_sys_bpf() and bpf_sys_close(), in the Linux kernel. These helpers can sleep while re‑entering with mutexes, allocating memory, or waiting for RCU grace periods. When a BPF program registers a timer callback, the verifier checks the callback in a non‑sleepable context but still permits the helper set. If the helper is invoked from such an atomic region, the kernel attempts to schedule while atomic, triggering a scheduling‑while‑atomic failure. This leads to a kernel panic or system crash, causing denial of service. The weakness aligns with CWE‑1322.

All Linux kernel implementations that have not incorporated the commit adding the .might_sleep attribute to the bpf_sys_bpf and bpf_sys_close prototypes are affected. This includes stock kernels from any distribution version released prior to the patch. Vendor products that ship unmodified Linux kernels without the fix are susceptible. Since the commit is not part of the stable release for many distributions, any running kernel built from sources before the fix is vulnerable, regardless of the version number.

The CVSS score of 5.5 reflects a moderate severity and moderate attack complexity. The EPSS score of <1% indicates a low probability of exploitation at present, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that an attacker would need privileged access to load a BPF program and that the likely attack vector is a local execution of a crafted BPF program that registers a timer callback. When the helper is invoked from a non‑sleepable context, it can trigger a scheduling‑while‑atomic failure, leading to a kernel crash or reboot, effectively denying system availability.