The vulnerability lies in the way the Linux kernel validates a target CPU identifier supplied in the BPF_F_CPU flag of eBPF BPF_MAP_TYPE_PERCPU_ARRAY operations. The kernel compared this identifier against the total number of possible CPUs rather than the actual range of valid CPU IDs, allowing an out-of-range CPU ID to slip through. When such an invalid CPU ID reaches the per‑CPU map update path, the kernel attempts a memory copy that dereferences an invalid address, causing a kernel panic. The effect is a denial of service that occurs when an invalid CPU ID is passed to the per‑CPU map update. The underlying flaw is an out‑of‑bounds memory write, identified as CWE‑787. The CVE data does not state whether elevated privileges are required; based on the description it is inferred that a process capable of issuing such a bpf() call could trigger the crash.

All Linux kernel releases that implement eBPF map updates with the BPF_F_CPU flag are affected, with the risk most pronounced on arm64 architectures or virtualized environments where CPU IDs are non‑contiguous (e.g., QEMU guests with a device‑tree hole). Kernel builds before the commit that introduced the fix are vulnerable; current stable kernels that include the patch are no longer impacted.

The CVSS score of 7 indicates significant impact, and the EPSS score is <1%, indicating a very low but non-zero exploitation probability. The issue is not listed in CISA KEV, and the crash can potentially be triggered by a user who can invoke bpf() calls; however, the CVE data does not specify whether elevated privileges are required, so based on the description it is inferred that a process capable of crafting a BPF map operation with an out‑of-range CPU ID could cause the crash. This is a classic buffer overflow (CWE‑787). No public exploit is documented, but the required attack vector is simply supplying an out‑of-range CPU ID in a map operation.