The Linux kernel’s bpf loop verifier suffered a logic flaw that caused precision propagation for register R1 to be incorrectly reset during backtracking of callbacks. Because R1 tracks loop iteration counts, the verifier could mistakenly accept programs that were actually unsafe, creating a risk of arbitrary code execution within eBPF contexts. The weakness originates from an improper algorithmic handling of precision metadata in the verifier, allowing malicious eBPF programs to bypass safety checks. This flaw represents a significant threat to kernel integrity and user data confidentiality.

The vulnerability affects all Linux installations that include the default bpf subsystem in the Linux kernel, regardless of distribution. It is not tied to a specific kernel version in the provided data; however, the patch that resolves the issue has already been applied to stable branches and will be present in newer releases.

The CVSS score is not supplied, so the severity is not quantified, but the flaw enables the verifier to accept unsafe programs, indicating a high conceptual impact. No EPSS score is available, suggesting the exploitation probability is unclear and likely low until a public exploit is discovered. The vulnerability is not listed in the CISA KEV catalog, meaning it is not currently a known exploited vulnerability. Attackers would need to craft a specially crafted eBPF program that relies on the verifier’s incorrect precision handling, implying the attack vector is specialized but potentially feasible for an attacker with deep kernel knowledge.