A divide–by–zero error occurs in the Linux kernel’s internal helper btf_struct_walk when loading BPF programs that refer to a struct containing a flexible array with zero size. The function folds an accessed offset back into a single element using the modulo operator without verifying that the element type has non‑zero size, causing a division by zero and kernel panic. This flaw is classified as CWE-369 and results in a denial‑of‑service condition if an attacker can supply a BPF program that triggers the condition.

The flaw exists in the Linux kernel across all versions that expose BPF and BTF functionality and have not incorporated the patch. Users of any Linux distribution running a kernel prior to the commit that adds the check are affected. The problem originates in the core kernel source, impacting all variants that compile the BPF subsystem.

The CVSS score of 4.4 places the vulnerability in the medium severity range. Exploitation requires the ability to load a BPF program that proceeds past a struct ending with an empty flexible array, a capability normally available only to privileged users or CAP_SYS_ADMIN. No publicly available exploits are known and the vulnerability is not listed in CISA’s KEV catalog. With an EPSS score of < 1%, the likelihood of real‑world exploitation is low, yet an attacker who can achieve the required privilege can force a kernel panic, causing a denial of service.