A flaw in the Linux kernel’s eBPF kprobe implementation causes a crash when a probe lands inside a CS‑prefixed CALL instruction. This weakness is identified as CWE‑823. The bug assumes a 5‑byte CALL, but the CS CALL is 6 bytes long, leading the kernel to construct an incorrect return address. When the CPU resumes after the kprobe, it jumps to the midpoint of the instruction, decodes an unrelated sequence, and triggers a page fault, resulting in a kernel panic. This failure interrupts the system, causing a denial of service.

All Linux kernel builds that do not include the submitted source patch for eBPF kprobe CS CALL handling. The affected vendor is Linux, and no specific version range is listed, so any kernel before the fix is considered vulnerable.

The CVSS score of 7.0 indicates a medium‑high severity vulnerability. The EPSS score indicates a low exploitation probability (<1%). The issue is not listed in CISA’s KEV catalog, suggesting it has not been actively exploited in the wild at this time. Based on the description, it is inferred that the likely attack vector is an eBPF probe stepping into a CS CALL instruction; any user capable of deploying such a probe can trigger a system crash. Because it causes a denial of service rather than code execution, the risk profile is moderate but still significant for system availability.