In the Linux kernel, BPF objects may own other objects through kernel pointers. During deallocation the kernel follows these pointers recursively before freeing the object’s storage. A self‑referential pointer or an arbitrarily deep chain of such pointers can cause the kernel stack to overflow when the head object is dropped. The vulnerability allows an attacker to craft a BPF program that creates a chain of nested objects, potentially crashing the kernel and causing a denial‑of‑service. The weakness is an uncontrolled recursion flaw.

The flaw exists in the Linux kernel; specific affected releases are not listed in the advisory, so any kernel build without the downstream commit that implements the ownership bound is potentially vulnerable. The vulnerability is tied to the bpf subsystem, particularly the handling of BTF records and local kernel pointers.

Because the flaw can cause a stack overflow during object cleanup, an attacker must be able to load malicious BPF code that establishes long, nested ownership chains. The code path is kernel‑space only, so the attack requires local execution privileges or the ability to influence BPF program loading. The EPSS score is not available, and the flaw is not yet listed in CISA KEV, but the CVSS implied severity would be high, given that a kernel crash can lead to privilege escalation or downtime. The likely attack vector is through an elevated user or compromised process that compiles and loads a malicious BPF program designed to trigger the recursive free. The skew exists in the absence of the updated stack‑bound logic, so patching is critical.