The Linux kernel helper function xsk_map_gen_lookup performs a comparison between a 32‑bit key and the map’s max_entries field using a BPF_JMP_IMM opcode. Because immediate values are sign‑extended to 64 bits, a max_entries value of 0x80000000 or larger is interpreted as a signed number greater than any unsigned 32‑bit key, causing the bounds check to be bypassed. This results in a lookup that reads past the end of the xsk_map array, potentially corrupting kernel memory or triggering a kernel panic, which effectively causes a denial of service. The weakness is an improper unsigned/signed comparison that can lead to an out‑of‑bounds read (CWE‑190 and CWE‑788).

All Linux kernel distributions that include the vulnerable implementation of xsk_map_gen_lookup are affected. Any distribution using a kernel version prior to the patch which addresses this sign‑extension bug is vulnerable, regardless of vendor or distribution name. Administrators should verify whether the running kernel contains the specific code path referenced in the advisory.

Exploitation requires loading a BPF program that creates an XSK map with a max_entries value at or above 0x80000000. Loading BPF programs normally demands kernel‑level privileges such as CAP_BPF, so the attack surface is limited to privileged users or misconfigured systems exposing BPF interfaces. Because no EPSS score is available and the vulnerability is not in the CISA KEV catalog, the current exploitation probability is uncertain, but the potential impact of an out‑of‑bounds read is high, as it can precipitate a kernel panic or data corruption. The lack of publicly documented exploits suggests a lower immediate risk, yet the severity warrants timely remediation.