BPF_F_CPU encodes the target CPU ID in the upper 32 bits of a BPF map operation flag. The kernel compared that ID against the total number of possible CPUs (num_possible_cpus) rather than the real bounds, allowing an invalid CPU ID to reach the per‑CPU map and trigger a kernel panic. The crash is a denial‑of‑service that could be triggered by writing or reading a map with an out‑of‑range CPU ID. The flaw lies in incomplete boundary checking and improper validation of CPU identifiers.

All Linux kernel builds that support eBPF, particularly those running on arm64 or other architectures where CPU ids can be sparse. The vulnerability is documented for arm64 QEMU guests with a device‑tree hole causing a non‑contiguous CPU mask. Any kernel version prior to the patch that includes the commit fixing BPF_F_CPU validation is affected.

The issue is not listed in CISA KEV and the EPSS score is not available, indicating limited public exploitation data. However the vulnerability leads directly to a kernel panic, so the impact is significant. An attacker with a user‑level bpf() call (or any program able to issue BPF system calls) could trigger the crash by constructing a map operation with an invalid CPU ID. The flaw is low false‑positive risk but high potential damage once triggered. No exploit in public repository is documented yet.