The defect lies in the Linux kernel’s eBPF verifier, which can incorrectly assume that a pointer is non‑null when verifying BPF programs. An attacker can supply a malicious BPF bytecode that performs a comparison between two pointers, one of which is actually null at runtime. Because the verifier fails to notice this, the program may dereference a null pointer, leading to a kernel crash or memory corruption. This flaw does not immediately grant arbitrary code execution, but it can cause loss‑of‑service or provide an avenue for privilege escalation if the crash is exploited in a wider context.

Any system running a Linux kernel with the BPF verifier component is potentially affected. No specific kernel version range is provided, so all builds prior to the commit that introduced the fix are included.

The CVSS score is not provided, and there is no EPSS data; the vulnerability is not listed in CISA’s KEV catalog. The most likely attack vector is the submission of a crafted BPF program to the kernel, a privilege that requires EXECVE‑level access or root privileges. Because the flaw is introduced during verification, an attacker cannot directly execute code, but the verifier’s failure can lead to a null pointer dereference and a subsequent kernel panic – a moderate to high severity impact if exploitation is possible. The lack of exploitation evidence and the absence of a public exploit suggest that the immediate risk is lower, but an unpatched kernel remains vulnerable to denial of service attacks.