The Linux kernel’s bpf subsystem contains a flaw in the regsafe() function, which incorrectly preserves packet pointer displacement across registers sharing the same packet pointer ID. This allows a bounds check performed on one member of a packet‑pointer class to be incorrectly applied to all members, so a subsequent access can read or write beyond the intended packet bounds, potentially corrupting kernel memory. The issue arises only in kernel versions that contain the pre‑fixed regsafe() code and can be leveraged by a malicious user capable of loading BPF programs.

All Linux kernel releases that include the bpf regsafe() implementation before the commit that introduces the corrected pointer offset (commit 022ac07508…) are affected. In practice any distribution that ships the upstream kernel without that patch is at risk, regardless of vendor. Specific version ranges are not enumerated in the advisory, so systems should verify whether their running kernel series incorporates the fix.

The CVSS score of 6.7 indicates moderate severity, while the EPSS score of < 1% suggests a low probability of exploitation today. The flaw is not listed in CISA’s KEV catalog. Although exploitation requires the ability to load a BPF program—a privilege typically reserved for system administrators or privileged users—the potential for out-of-bounds access can lead to kernel memory corruption, which could grant elevated privileges or cause denial of service, making the vulnerability dangerous if an attacker manages to inject malicious BPF code.