The vulnerability arises in the Linux kernel BPF subsystem when a BPF map record is duplicated without preserving a reference to the map’s BTF metadata. During map teardown, the duplicated record is later accessed by a workqueue after the original map has been freed, resulting in a use‑after‑free detected by KASAN. This kernel memory corruption can cause a panic, but it also represents a potential vector for arbitrary code execution if an attacker can trigger the fault while the kernel is running.

All Linux kernel builds that include the unpatched BPF map handling logic are potentially affected. The vulnerability does not specify a particular release window; therefore any kernel version prior to the fix, regardless of vendor or distribution, may be impacted. Users running custom kernels or those that employ BPF maps in user space are also within scope.

The CVSS score of 4.4 indicates moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on typical usage of BPF maps, it is inferred that privileged users (e.g., CAP_SYS_ADMIN) who can create or delete BPF maps are required to experience the flaw, and the likely attack vector is local privileged exploitation. An attacker could trigger the fault by freeing a map that remains referenced, leading to kernel crash or code execution.