The Linux kernel helper function xsk_map_gen_lookup performs a comparison between a 32‑bit key and the map’s max_entries field using a BPF_JMP_IMM opcode. Because immediate values are sign‑extended to 64 bits, a max_entries value of 0x80000000 or larger is interpreted as a signed number greater than any unsigned 32‑bit key, causing the bounds check to be bypassed. This results in a lookup that reads past the end of the xsk_map array, potentially corrupting kernel memory or triggering a kernel panic, which effectively causes a denial of service. The weakness is an improper unsigned/signed comparison that can lead to an out‑of‑bounds read (CWE-125).

All Linux kernel distributions that include the vulnerable implementation of xsk_map_gen_lookup are affected. Any distribution using a kernel version prior to the patch which addresses this sign‑extension bug is vulnerable, regardless of vendor or distribution name. Administrators should verify whether the running kernel contains the specific code path referenced in the advisory.

Exploitation requires loading a BPF program that creates an XSK map with a max_entries value at or above 0x80000000. Loading BPF programs normally demands kernel‑level privileges such as CAP_BPF, so the attack surface is limited to privileged users or misconfigured systems exposing BPF interfaces. The CVSS score of 4.4 indicates moderate severity, underscoring that while the vulnerability is not critical, timely remediation is advised. The EPSS score of <1% indicates a very low but nonzero probability of exploitation, and the vulnerability is not listed in CISA's KEV catalog. Despite the low probability, the potential impact of an out‑of‑bounds read is high, as it can precipitate a kernel panic or data corruption. The lack of publicly documented exploits suggests a lower immediate risk, yet the severity warrants timely remediation.