A flaw in the Linux kernel’s BPF module miscalculates the offset for per‑CPU array, hash, and cgroup storage map updates when the system’s CPU mask is sparse. The code assumes logically contiguous CPU IDs starting at zero, but with non‑contiguous IDs the computed offset skips valid slots, causing out-of-bounds reads and corrupted per‑CPU values. An attacker with the ability to load malicious BPF programs could invoke this logic and read or corrupt sensitive kernel memory, potentially leading to privilege escalation.

All Linux kernel releases that precede the fix (the commits referenced in the advisory). The issue affects every distribution that ships the unpatched kernel, regardless of vendor. All CPUs that are present but not contiguous in the possible CPU mask are susceptible.

Based on the description, it is inferred that the likely attack vector is a local user or an attacker who can load BPF programs. No CVSS score or EPSS value is provided, limiting precise quantification. The bug does not require kernel privileges to trigger; a local user or compromised BPF program can exploit it. Because it leads to out-of-bounds memory access, the potential impact is high if abused. The vulnerability is not listed in the CISA KEV catalog, so no widespread exploitation has been reported yet.