BPF programs in the Linux kernel undergo a series of post‑verification rewrites that currently cannot be canceled or preempted. After the main verifier finishes, each rewrite pass may move or delete instructions and adjust metadata, making the overall work quadratic in program length. A malicious privileged loader can create a program containing a large number of no‑op jumps followed by a return; verification completes quickly, but the rewrite passes then spend a long time cleaning each jump. Because this process does not check for signals or reschedule, a SIGKILL sent after the load cannot terminate the task until all rewrites finish, effectively preventing the kernel from responding to user requests and causing a denial‑of‑service condition for the loading process.

The flaw is present in all Linux kernel builds that include the eBPF verifier and have not applied the patch. Systems that allow privileged users to load BPF programs are affected; any kernel version prior to the patch that supports BPF is vulnerable. The issue is limited to the verifier path; kernel configurations that disable BPF or restrict program loading to unprivileged contexts mitigate the impact.

The CVSS score of 2.3 indicates a low severity, and the EPSS score of <1% suggests a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Attack requires elevated privileges to load a malformed BPF program. Because the rewrite passes are not preemptible, a privileged attacker can stall the process until the rewrites finish, potentially preventing task termination and creating a service disruption for that user or potentially for system‑wide resource exhaustion if many such loads are performed.