In the Linux kernel, the bpf verifier can inappropriately convert a half‑dead scalar zero spill into a STACK_ZERO value. This flaw disrupts precision propagation chains and can allow a malformed eBPF program to pass verification even though it is invalid. The vulnerability is a CWE-843 type flaw involving improper handling of precision propagation, and can potentially allow an attacker to gain kernel execution privileges. While the CVE description does not explicitly claim privilege escalation, a successful bypass could enable the execution of arbitrary code in the kernel context by the attacker, potentially granting elevated privileges.

All Linux kernel releases that do not contain the patch 2f3536bff8823d3c5fdbbe15e17bfca696cc2b2e or the equivalent commit are vulnerable. This includes every upstream Linux kernel version prior to the inclusion of the fix, as the vulnerability was present in the kernel code and not tied to a particular downstream distribution. The affected product is the Linux kernel, used as the core operating system in all Linux distributions.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score of less than 1% suggests a low current likelihood of exploitation. The vulnerability is not yet listed in CISA’s KEV catalog, implying it has not been observed in the wild. An attacker would need the ability to load eBPF programs and craft a malicious program that triggers the zero‑spill downgrade. In hardened environments where eBPF loading is restricted, the risk is further reduced, but systems that allow user‑space BPF loading remain potentially vulnerable.