The vulnerability stems from the Linux kernel BPF verifier incorrectly treating packet‑memory pointers (PTR_TO_PACKET) as generic memory pointers (PTR_TO_MEM) when they cross subprogram boundaries. This oversight allows a BPF subprogram that mutates packet data to be called with a pointer that is not guaranteed to remain valid. The resulting pointer misuse can lead to kernel memory corruption, potentially compromising the integrity of the kernel or causing a denial of service. The weakness aligns with CWE-825.

All Linux kernel implementations that include the unpatched BPF verifier logic are subject to this flaw. While specific kernel versions are not enumerated in the advisory, the patch commits referenced in the advisory are present in newer releases, so any system running a kernel older than those commits is affected.

The CVSS score of 6.7 indicates moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation at present. The flaw is not listed in CISA’s KEV catalog. The likely attack vector is a user or process with permission to load BPF programs into the kernel. Based on the description, it is inferred that such an attacker could inject a malicious BPF subprogram that passes a packet pointer to a mutating routine, leading to memory corruption.