The vulnerability lies in the way the Linux kernel validates a target CPU identifier supplied in the BPF_F_CPU flag of eBPF BPF_MAP_TYPE_PERCPU_ARRAY operations. The kernel compared this identifier against the total number of possible CPUs rather than the actual range of valid CPU IDs, allowing an out‑of‑range CPU ID to slip through. When such an invalid CPU ID reaches the per‑CPU map update path, the kernel attempts a memory copy that dereferences an invalid address, causing a kernel panic. The effect is a denial of service that can be triggered by any user‑level program that can invoke the bpf() system call with a malformed map operation.

All Linux kernel releases that implement eBPF map updates with the BPF_F_CPU flag are affected, with the risk most pronounced on arm64 architectures or virtualized environments where CPU IDs are non‑contiguous (e.g., QEMU guests with a device‑tree hole). Kernel builds before the commit that introduced the fix are vulnerable; current stable kernels that include the patch are no longer impacted.

The CVSS score of 7 indicates significant impact, and while the EPSS score is not available and the issue is not listed in CISA KEV, the crash can be forced by a malicious user who can execute bpf() calls. No public exploit is documented, but the required attack vector is simply supplying an out‑of‑range CPU ID in a map operation, which does not require elevated privileges.