The vulnerability is in the Linux kernel bpf subsystem. regsafe() incorrectly preserves packet pointer displacement, allowing a bounds check performed on one member of a packet pointer class to propagate to all members with the same ID. Consequently a later access can step outside the bounds of the packet, producing an out-of-bounds read or write that may corrupt kernel memory. This flaw could be leveraged by a malicious BPF program to gain elevated privileges or crash the system.

The flaw exists in all kernel versions that contain the bpf regsafe() implementation before the commit that introduces the corrected pointer offset. All platforms running the Linux kernel are potentially affected. Specific versions are not enumerated; enterprises should check whether their kernel series includes the commit 022ac075 or equivalent. The vendor identification shows "Linux:Linux", indicating any distribution that ships the upstream kernel.

The CVSS and EPSS scores are not listed, and the vulnerability is not currently included in CISA's KEV database. The impact of an out-of-bounds packet access in the kernel is severe, especially if a malicious BPF payload can be injected. The flaw could be leveraged by a local attacker, as BPF program loading normally requires process-level privileges. The lack of publicly available exploits does not reduce the risk of future attacks; the kernel's central role makes the flaw inherently dangerous.