The bug exists in the function skb_pointer_if_linear(), which verifies whether a requested slice of an skb lies within its linear buffer. The function performs an unsigned subtraction of the requested offset from the skb's linear length; because both operands are unsigned, the subtraction can underflow. When this underflow occurs the bounds check spuriously succeeds and the function returns a pointer into memory outside the skb’s linear area. The helper is used by skb-backed BPF dynamic pointers, so the incorrect pointer is later supplied as the backing memory for a BPF program’s dynamic pointer. If an attacker can force the kernel to invoke this helper with a crafted packet or by loading a malicious BPF program, the program may read or write data beyond the intended skb boundary, leading to arbitrary kernel memory corruption.

All Linux kernel builds that include the skb‑backed BPF dynamic pointer feature are affected. The advisory does not list specific kernel versions, so any current or recent kernel with this functionality is potentially vulnerable.

The EPSS score is below 1% and the CVSS score of 6.7 indicates a moderate severity. The advisory does not describe an explicit attack vector, but based on the description it is inferred that an attacker who can influence the contents of a packet processed by the kernel or who can load a malicious BPF program might trigger the bug. If successful, the flaw could allow a BPF program to read or write arbitrary kernel memory, compromising confidentiality, integrity, or availability. The vulnerability is not listed in the CISA KEV catalog.