The Linux kernel BPF subsystem allows custom bytecode to be executed in kernel space. This vulnerability enables malicious metadata to alter relocatable instructions such as jumps, calls, exits, register‑source arithmetic, or non‑immediate loads before the target is validated, effectively poisoning the program counter or other critical CPU state. An attacker could force a victim program to execute unintended instructions, potentially leading to privilege escalation or arbitrary code execution.

All Linux kernel releases that contain the bpf CO-RE relocation logic are affected. No specific version range was provided, so any kernel build using the default BPF bytecode loader is considered vulnerable until the patch is applied.

The CVSS score of 4.4 represents a low severity vulnerability, and the EPSS score of <1% indicates a very low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector, inferred from the BPF subsystem behavior, would involve an attacker feeding malformed BPF bytecode or metadata that contains CO‑RE relocation records with unresolved offsets, allowing the kernel to poison relocatable instructions such as jumps or calls before validation, potentially leading to unintended code execution.