The kernel bug causes the BPF exception callback prologue on arm64 to neglect setting the frame pointer, so BPF_REG_FP points at an invalid stack frame that belongs to a subprogram that never returned. When a helper function is passed the address of a local variable, it writes back into that dead frame and can overwrite the helper’s return address, resulting in a kernel crash or, at worst, arbitrary kernel code execution. This flaw is essentially a memory corruption vulnerability that can be triggered by a user‑space BPF program designed to throw an exception and pass a pointer derived from its own stack.

All Linux kernels compiled for arm64 that contain the BPF subsystem are potentially affected; the CNA lists the generic product "Linux:Linux" with no explicit version range, implying that any arm64 kernel build with BPF support may have the defect unless it has been back‑patched. No version details are available from the data.

The CVSS score of 4.4 and EPSS score of < 1% indicate a moderate severity and low probability of exploitation. The issue is not in CISA’s KEV catalog, suggesting no publicly known exploits yet. However, the flaw requires the attacker to load a BPF program and trigger the exception path, a capability that user processes typically possess. If exploited, the kernel could crash or be coerced into executing arbitrary code, giving the attacker elevated privileges. The vulnerability can therefore be considered a medium risk pending patch status.