A flaw in the Linux kernel’s BPF module miscalculates the offset for per‑CPU array, hash, and cgroup storage map updates when the system’s CPU mask is sparse. The code assumes logically contiguous CPU IDs starting at zero, but with non‑contiguous IDs the computed offset skips valid slots, causing out‑of‑bounds reads and corrupt per‑CPU values. This bug allows a local user who can load malicious BPF programs to read or corrupt kernel memory, potentially leading to privilege escalation. Based on the description, it is inferred that an attacker can exploit the flaw by running a BPF program with otherwise normal user privileges.

All Linux kernel releases that precede the fix. Every distribution shipping an unpatched kernel is affected, regardless of vendor. The vulnerability applies to systems where the possible CPU mask is non‑contiguous, such as a CPU mask of 0,2-3.

The CVSS score of 5.5 indicates moderate severity, while the EPSS score of <1% suggests a very low likelihood of exploitation. The vulnerability does not require elevated kernel privileges to be triggered; it relies on a local user’s ability to load BPF programs. Because it results in out‑of‑bounds memory access, the potential impact is moderate. The vulnerability is not listed in the CISA KEV catalog, so no widespread exploitation has been reported.