The Linux kernel BPF subsystem has a flaw in handling key-less BTF types for hash maps; the map_check_btf() function was extended to accept a key-less BTF for hash maps due to new callbacks, but those callbacks do not validate the key, allowing a hash map with btf_key_type_id set to 0 to be created. When accessed through bpffs, the kernel attempts to resolve a BTF type of id 0, which maps to the void type; the code then dereferences a null kind_ops pointer, causing a null pointer dereference that results in a kernel panic. The vulnerability therefore allows an attacker to force the kernel to crash, leading to denial of service.

All Linux kernels that contain the commits 1df97a7453ee (htab) and 6905f8601298 (rhtab) are affected; since the CVE does not list specific version numbers, any system running a kernel that includes these buggy callbacks or prior to the fixes is susceptible. System administrators should verify the presence of these commits in the running kernel or consult distribution release notes for the vulnerable upstream code.

The CVSS score is not provided, but the kernel panic indicates a high severity impact. EPSS data is unavailable, so the likelihood of exploitation is unknown; based on the description it is inferred that a local attacker able to load BPF programs or read bpffs can trigger the crash, providing a local denial of service. The vulnerability is not listed in the CISA KEV catalog, and no public exploit is reported, yet the crash can be leveraged to disrupt critical workloads; updating the kernel or disabling BPF features is the only effective mitigation.