A high-severity memory corruption vulnerability in the Linux kernel eBPF subsystem allows local attackers to potentially gain elevated privileges or cause system crashes.

This is a memory management issue within the sockmap implementation of the eBPF subsystem. The vulnerability occurs due to improper tail fragment offset calculation during data insertion, which affects unauthenticated local users.

Successful exploitation of this kernel-level vulnerability could allow a local attacker to corrupt memory, leading to unauthorized privilege escalation or a complete system denial of service. With a CVSS score of 8.4, this vulnerability represents a significant risk to system integrity and availability, particularly in multi-tenant environments or systems where local user access is permitted.

Immediate Action: Update the Linux kernel to version 5.10.259, 5.15.210, 6.1.176, 6.6.143, or later as appropriate for your distribution.

Proactive Monitoring: Monitor system logs for kernel panics or unexpected process crashes that may indicate exploitation attempts.

Compensating Controls: Restrict access to the eBPF subsystem by adjusting sysctl settings, specifically setting kernel.unprivileged_bpf_disabled to 1.

Public Exploit Available: No

Given the potential for privilege escalation, administrators should prioritize patching the kernel across all affected production environments. If an immediate reboot is not feasible, ensure that unprivileged eBPF access is strictly disabled via system configuration to reduce the attack surface.