The vulnerability occurs in the Linux kernel's BPF subsystem where an unsettled link is inserted into the IDR before it is settled. When this link is later referenced by the link iterator, the iterator takes a reference without checking its status. If the creation of the link fails, the link becomes freed while the iterator still holds a dangling reference, leading to a use‑after‑free in bpf_link_put that triggers a kernel panic.

This bug affects all Linux kernel builds that do not incorporate the patch. No specific version range is listed; any kernel lacking the commit that introduced the fix is vulnerable. Users should verify that their kernel includes the revisions referenced in the advisory.

The CVSS score of 7.8 indicates a medium severity vulnerability, and the EPSS score of < 1% indicates a very low but nonzero probability of exploitation. The issue does not appear in the CISA KEV catalog, suggesting no confirmed exploitation. Based on the description, it is inferred that a local attacker who can create BPF link objects can trigger the flaw, making the attack vector likely local. The bug can cause a kernel panic (Denial of Service).