The vulnerability occurs in the Linux kernel’s BPF subsystem, where a missing migration guard around a batch deletion routine can cause the kernel to BUG. When the processor ID is read while a task has migrated between CPUs, the kernel triggers a fault that can lead to a crash. The impact is a denial of service by destabilizing the entire system, with no direct privilege escalation indicated in the description.

All Linux kernel installations that contain the __rhtab_map_lookup_and_delete_batch function are potentially affected. The vulnerability applies to any kernel configuration that enables CONFIG_PREEMPT_RCU, as this mode removes preemption and migration protection for the code path in question. No specific kernel version range is provided, so any current or recent kernel build that has not been patched needs assessment.

The CVSS score of 4.1 categorizes this vulnerability as low to moderate risk. The EPSS score of less than 1% suggests a low likelihood of exploitation. Although the issue is not listed in the CISA KEV catalog, the kernel panic could still impact availability. The primary vector likely remains normal BPF map operations performed by privileged users or services.