The Linux kernel bug in the BPF JIT on MIPS32 misuses the addu instruction instead of addiu when emitting immediate JMP JEQ/JNE instructions. This causes an immediate value of 1 to be treated as register $at, which is also used as the constant blinding register BPF_REG_AX. As a result, comparisons involving negative immediate operands produce incorrect results, potentially leading to faulty branch decisions within BPF programs. The flaw could enable malicious code to bypass intended logic or access incorrect memory locations, compromising kernel integrity.

Linux kernel builds for MIPS32 CPUs, including MIPS32r1 emulated environments. All kernel versions that contain the unpatched BPF JIT path.

The vulnerability has an EPSS score indicating a very low exploitation probability (< 1%) and is not yet listed in the CISA KEV catalog. The CVSS score of 4.4 indicates moderate severity. Its exploitation requires the ability to load or execute a malicious BPF program on a system running an affected MIPS32 kernel, which is typically limited to users with elevated privileges or processes that can load BPF programs. While the control‑flow error is kernel‑level and could allow local privilege escalation, the overall risk depends on attacker access and the presence of other conditions, making it a moderate‑impact issue for systems that rely on BPF for kernel tracing or packet filtering.