Internal kernel code that manages BPF trampoline images has a flaw where detaching a BPF program can release the program’s reference counter immediately, while a task is still executing through that program in a trampoline image. The missing reference handling allows the kernel to free the program’s memory before all executing contexts have finished, leading to an integer exception and a kernel oops, which effectively crashes the host. This represents a use-after-free vulnerability that can be leveraged to destabilize the system and potentially execute arbitrary code if an attacker can control the detachment sequence. The weakness is based on improper resource lifetime management and race conditions.

All Linux kernels that include BPF trampoline support but do not yet incorporate the described patch, including the kernel version illustrated in the trace (6.18.44). The issue appears on multiple architectures such as x86, riscv, and loongarch. Users unable to upgrade to a fixed kernel will remain affected.

The CVSS score is not provided, but the kernel crash impact is severe. EPSS is not available, and the vulnerability is not listed in CISA’s KEV catalog. The attack likely requires a user with the ability to load and detach BPF programs—typically privileged or root access. An attacker could trigger the flaw by disabling a running BPF program while it is still in use, causing a denial‑of‑service condition and potentially enabling further exploitation if arbitrary code execution were possible from the crash context.