Internal kernel code that manages BPF trampoline images has a flaw where detaching a BPF program can release the program’s reference counter immediately, while a task is still executing through that program in a trampoline image. The missing reference handling allows the kernel to free the program’s memory before all executing contexts have finished, leading to an integer exception and a kernel oops, which effectively crashes the host. This represents a use-after-free vulnerability that can be leveraged to destabilize the system and potentially execute arbitrary code if an attacker can control the detachment sequence. The weakness is based on improper resource lifetime management and race conditions.

All Linux kernels that include BPF trampoline support but do not yet incorporate the described patch, including the kernel version illustrated in the trace (6.18.44). The issue appears on multiple architectures such as x86, riscv, and loongarch. Users unable to upgrade to a fixed kernel will remain affected.

The CVSS score of 4.4 indicates a moderate severity vulnerability. The EPSS score of < 1 % implies that, at the time of this analysis, exploitation is unlikely in the wild. This issue is not listed in CISA's KEV catalog. The flaw can be triggered by a privileged user who can load and detach BPF programs; the attacker could cause the kernel to crash by detaching a program that is still executing in a trampoline image, resulting in a denial‑of‑service. While the crash does not directly allow arbitrary code execution, it can serve as a foothold for further attacks if an attacker can leverage the resulting kernel panic.