The Linux kernel’s eBPF code generator incorrectly emits a 64‑bit move when loading the socket field ‘rx_queue_mapping’ into the bpf_sock context, sign‑extending a 2‑ or 4‑byte value and causing the verifier to underestimate the register contents. This discrepancy can lead to a crafted BPF program manipulating internal kernel state or performing unsafe memory accesses, potentially allowing privilege escalation.

The defect resides in generic bpf_sock context handling, meaning every Linux kernel that exposes the eBPF framework is affected. No specific kernel version ranges are listed; therefore all current standard distributions are potentially impacted until the patch is applied.

The CVSS score is 6.7 and the EPSS score is below 1%, indicating a moderate severity and low exploitation probability. The flaw is not listed in CISA’s KEV catalog. Exploitation requires loading a malicious BPF program with sufficient privileges (e.g., CAP_SYS_ADMIN). The most likely attack vector is the injection of a crafted BPF program that exploits the sign‑extension error to alter kernel data structures or control flow.