The Linux kernel BPF subsystem has a flaw in handling key-less BTF types for hash maps; the map_check_btf() function was extended to accept a key-less BTF for hash maps due to new not validate the key, allowing a hash map with btf_key_type_id set to 0 to be created. When accessed through bpffs, the kernel attempts to resolve a BTF type of id 0, which maps to the void type; the code then dereferences a null kind_ops pointer, causing a null pointer dereference that results in a kernel panic. The vulnerability therefore allows an attacker to force the kernel to crash, leading to denial of service.

All Linux kernels that contain the commits 1df97a7453ee (htab) and 6905f8601298 (rhtab) are affected; since the CVE does not list specific version numbers, any system running a kernel that includes these buggy callbacks or prior to the fixes is susceptible. System administrators should verify the presence of these commits in the running kernel or consult distribution release notes for the vulnerable upstream code.

The CVSS score of 5.5 indicates a moderate severity of the flaw. The kernel panic caused by a null pointer dereference is still arguably a high-impact outcome for a local attacker, but the official metric reflects that the vulnerability is not critical. The EPSS score of < 1% signals a very low probability that this issue will be actively exploited in the near term. The flaw is not listed in CISA’s KEV catalog, and there are no confirmed public exploits. The likely attack vector is local: an attacker with the ability to load BPF programs or read the bpffs filesystem can trigger the crash, leading to a denial of service. Updating the kernel to a version that includes the patch for key-less BTF validation in the htab and rhtab code remains the recommended course of action.