In the Linux kernel a BPF program can load a reference to the main function that is not rewritten by the JIT compiler. The kernel assumes that only subprograms are used as callbacks, so the address is never replaced when the program contains a main‑to‑BPF reference. Combined with callback registration functions such as bpf_timer_set_callback, this allows the program to invoke an arbitrary, attacker‑supplied address, which results in kernel‑level code execution. The flaw is caused by an unchecked indirect function pointer and threatens confidentiality, integrity, and availability of the entire system.

Systems running Linux kernel versions not yet patched for the commit that rejects main subprogram BPF_PSEUDO_FUNC references are affected. This includes all mainstream Linux distributions that shipped the vulnerable kernel revision prior to the code fix.

The CVSS score of 7.0 indicates high severity while the EPSS score of less than 1% suggests low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit this flaw by loading malicious BPF bytecode from user space, typically via privileged processes or kernel module interfaces. Until the kernel is updated, the risk remains significant, especially for environments that run user‑supplied BPF programs.