A flaw in the Linux kernel BPF subsystem allows a privileged user with CAP_BPF and CAP_NET_ADMIN to attach a BPF link to a network device that is different from the device the program was bound to. The internal matching logic mistakenly compares device pointers after an exact netdev mismatch, causing a bound-only program to inherit an offload device and match a sibling port. This can lead to a null pointer dereference or an out‑of‑bounds read in the device's xdp_buff, resulting in a general protection fault and a kernel panic. The effect is a denial of service for the host.

Linux kernels that have not incorporated the patch that corrects __bpf_offload_dev_match are vulnerable. No specific version numbers are listed in the advisory; the issue applies to any build that includes the unpatched logic for the BPF offload handling. The vulnerability is applicable across all architectures that compile the BPF MDP code.

The CVSS score of 7.8 indicates moderate‑high severity. The EPSS score is below 1%, implying a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog and no public exploits are reported, but it requires local privileges (CAP_BPF and CAP_NET_ADMIN). In environments where trusted users can create BPF links, an attacker can trigger a kernel crash and consequently a denial of service; therefore prompt remediation is advised despite the low exploitation probability.