The Linux kernel’s eBPF verifier incorrectly assumes non‑nullness for certain pointer comparisons, allowing malicious BPF programs to compare a nil pointer with a valid one. Because the verifier fails to detect the null dereference, the program may write to address zero, causing a kernel crash or memory corruption. This flaw does not grant arbitrary code execution; the direct consequence is a loss of service due to a kernel panic. The vulnerability is rooted in the CWE-476 Undefined Behavior: Null Pointer Dereference category.

Any Linux kernel that includes the BPF verifier before the commit that introduced the fix is potentially affected. The CVE note does not specify a kernel version range, so all builds prior to the patch are considered vulnerable. The issue is present in both vanilla Linux and all distributions that ship the affected kernel code.

The CVSS score of 5.5 indicates a medium severity flaw. The EPSS score is reported as <1%, suggesting a low probability of exploitation at the time of reporting, and the vulnerability is not listed in CISA’s KEV catalog. The most likely attack vector is the submission of a specially crafted BPF program to the kernel, which could trigger a null dereference and kernel panic. No publicly available exploit or evidence of exploitation exists, but an unpatched system remains at risk for denial of service attacks from attackers able to load malicious BPF programs.