The Linux kernel BPF subsystem contains a flaw in the comparison of a per‑CPU array inner map’s maximum entry count. The kernel uses a generic equality function that neglects to compare the actual max_entries value. When a per‑CPU array is replaced by a smaller inner map, that check is bypassed, allowing a lookup operation to access the map’s pointer array beyond its bounds. This out‑of‑bounds read occurs inside the kernel, potentially exposing kernel memory contents.

All installations of the Linux kernel that include the BPF framework are potentially affected, regardless of vendor. Linux distributions that have not applied the patch that enforces array_map_meta_equal for percpu array inner maps remain vulnerable. Since affected kernel versions are not specified, users should verify whether their current kernel releases contain the fix.

The vulnerability is scored at CVSS 7.8, which classifies it as high severity. The EPSS score of <1% indicates that current exploitation probability is low and the issue is not listed in CISA KEV. Based on the description, the likely attack vector involves an attacker with the ability to load or modify BPF programs that run with kernel privileges—this inference is drawn because the flaw deals with BPF map manipulation rather than an externally exposed interface. While the out‑of‑bounds read can leak kernel data, no evidence is provided regarding privilege escalation or denial‑of‑service outcomes.