In the Linux kernel, a flaw in the BPF verifier’s backtracking logic causes a crash when the verifier encounters certain load instructions that implicitly exit a subprogram. The missing call to restore the calling context leaves the verifier manipulating state in the wrong frame, which can lead to segmentation faults during verification. The result is a kernel panic that can terminate user processes or render the system unresponsive, effectively providing a denial of service background for the affected host.

The defect applies to any Linux kernel that implements the BPF verifier without the corrective logic found in commits 387b1baefbb7 and 671b7b9a660e. Operating systems still running a kernel that does not incorporate these commits are vulnerable. The issue is not tied to a particular distribution version but to the presence or absence of the patch, so all upstream and downstream kernels need to be examined for the backtrack_insn function.

Although a public exploit is not listed in CISA KEV and the EPSS score is unknown, the bug can be triggered by any unprivileged user who can load a BPF program, making it a high‑impact denial of service vector. The severity of the crash and its ease of triggering emphasize the importance of updating the kernel. With the fix in place, backtracking correctly restores the calling context, eliminating the crash and preventing unsound state pruning that could otherwise allow policy bypass.