The Linux kernel BPF subsystem allows custom bytecode to be executed in kernel space. This vulnerability enables malicious metadata to alter relocatable instructions such as jumps, calls, and loads before the target is validated, effectively poisoning the program counter or other critical CPU state. An attacker could force a victim program to execute unintended instructions, potentially leading to privilege escalation or arbitrary code execution.

All Linux kernel releases that contain the bpf CO-RE relocation logic are affected. No specific version range was provided, so any kernel build using the default BPF bytecode loader is considered vulnerable until the patch is applied.

The CVSS score is not listed, and EPSS information is unavailable, so an exact risk ranking cannot be quantified. The vulnerability is not listed in the CISA KEV catalog at this time. The likely attack vector would involve an attacker feeding crafted BPF programs or metadata to a vulnerable host; once processed by the kernel, the poisoned instructions could be executed. Because the flaw affects low‑level kernel code, exploitation could occur without user interaction if the attacker can inject malformed BPF programs into the system.