The Linux kernel has a flaw in its signal tracepoints where the siginfo argument is incorrectly treated as a trusted pointer. In reality the argument can hold special scalar values, such as SEND_SIG_NOINFO (0) and SEND_SIG_PRIV (1). A BPF program that accesses this argument may dereference the scalar value, causing a kernel fault that can elevate to a panic. Because the signal_generate tracepoint can execute in timer interrupt context, the fault bypasses normal error handling and can crash the entire system. This leads to loss of availability and potentially allows local users to trigger a kernel panic via an engineered BPF program.

All Linux kernel installations that have not merged the commit that marks the siginfo argument as scalar. The fix applies to the Linux kernel source and therefore to all distributions that ship the affected kernel versions. No specific version numbers are listed in the advisory, so any kernel before the patch is considered vulnerable, especially those where the signal tracepoints exist. The vulnerability is present regardless of brand or distribution because it arises from the generic Linux kernel code.

The CVSS score is not provided, and the EPSS score is unavailable, indicating no publicly known exploitation statistics. However, the vulnerability can cause a kernel panic, which is a severe denial‑of‑service impact. As the vector involves a BPF program, an attacker would need to execute arbitrary BPF code on the target machine, typically a privilege escalation or local compromise scenario. The vulnerability is not listed in CISA’s KEV catalog, but the potential for a kernel crash makes it a high‑risk flaw in environments where untrusted BPF programs may run.