An integer overflow vulnerability in the Linux kernel BPF subsystem allows local attackers with low privileges to achieve high system impact, including potential code execution and denial of service.

The vulnerability is caused by an integer overflow during the calculation of repeated field counts in user-supplied BTF data during BPF_BTF_LOAD, leading to a heap-based buffer overflow via memcpy. The attacker authentication level requires local access with low privileges and no user interaction.

A successful exploit of this vulnerability could lead to complete compromise of confidentiality, integrity, and availability of the affected operating system. Because the CVSS score is 7.8, it represents a high severity risk where local privilege escalation or system crashes can severely disrupt business operations and compromise sensitive workloads hosted on the server.

Immediate Action: Update the Linux kernel to version 6.12.96, 6.18.39, 7.1.4, or later depending on the active distribution branch.

Proactive Monitoring: Monitor system logs for kernel panics, segmentation faults, or unauthorized execution of BPF programs.

Compensating Controls: Restrict unprivileged user namespaces and limit access to BPF loading capabilities using kernel hardening parameters if immediate patching is not feasible.

Public Exploit Available: No

Administrators must treat this high severity flaw with urgency by scheduling kernel updates across all deployed Linux instances. Applying the vendor-provided patches is critical to eliminate the risk of local privilege escalation and kernel corruption.