A vulnerable BPF verifier path allows a BPF program loaded with CAP_BPF to internally perform a tail call directly from a synchronous callback frame. The verifier mistakenly treats that tail call as a return, leading to an inconsistent register state. This causes the verifier to trigger a warning and ultimately fail the program load with an EFAULT. The failure disables the intended BPF functionality, resulting in a denial of service for any processes that depend on the program. The issue stems from improper register handling (CWE‑617).

All Linux kernel installations that include the BPF verifier logic prior to the patch are susceptible. The advisory does not list exact kernel versions, so any current or older revision may harbor the flaw until updated. System administrators should suspect all kernels running the BPF subsystem have the potential vulnerability and should assess their installed kernels against the patch status.

The CVSS base score for the flaw is 5.5 and the EPSS score is below 1 %, indicating a relatively low probability of exploitation. The vulnerability requires the CAP_BPF privilege, which is typically granted only by privileged users or services. Thus the attack surface is confined to local attackers with sufficient rights. The flaw is not marked in the CISA KEV catalog. While exploitation would not provide code execution, it can cause a denial of service for applications relying on BPF programs.