A flaw in the Linux kernel’s BPF verifier occurs when a tail call is performed directly from a synchronous callback frame. The verifier treats the call as a return and incorrectly marks register R0 as precise, triggering a verifier bug that leads to a warning and a failure (-EFAULT) when loading the BPF program. This results in the BPF program being rejected, effectively preventing the purpose of the program from running. The vulnerability does not provide direct code execution, but it can cause a denial of service for processes that rely on loading legitimate BPF programs.

Affected systems are Linux kernel installations. No specific kernel versions are listed in the advisory; therefore the vulnerability may exist in any kernel revision that contains the described logic before the patch. System administrators should consider that any current and previous kernel releases might be impacted until an update is applied.

The issue requires the attacker to have CAP_BPF capabilities to trigger the bad tail call, implying a local privilege requirement. Because CAP_BPF is a privileged capability, the risk of exploitation is limited to local or compromised users. The CVSS score is not provided, and the EPSS score is unavailable, so the exact likelihood cannot be quantified, but the impact is a denial of service for BPF program loading. The vulnerability is not listed in the CISA KEV catalog, indicating no known widespread exploitation at this time. However, the local nature of the attack vector and the denial of service outcome warrant prompt remediation.