The vulnerability arises in the Linux kernel's BPF subsystem, where a rbtree callback may execute a resilient lock operation that fails to keep the root lock held during callback execution. This oversight allows the callback to release the lock, enabling another CPU to remove and free the node currently being walked. The traversal then continues using freed pointers, creating a use-after-free condition. A successful exploitation could corrupt kernel memory and, in the kernel context, provide an attacker with the possibility of arbitrary code execution.

All Linux kernel configurations that incorporate BPF rbtree callbacks without the recent patch are affected. The vulnerability is present in any Linux kernel version prior to the commit that rejects resilient lock operations in rbtree comparison callbacks. Specific version ranges are not documented in the supplied data.

The CVSS score is 7.0, indicating high severity. The EPSS score is < 1%, suggesting a very low but nonzero exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Likely attack vectors involve running a malicious BPF program that performs a resilient lock operation within a rbtree comparison callback. Such a program would require local kernel access or elevated privileges, pointing to a potential local privilege escalation or kernel exploit path.