A memory management flaw in the Linux kernel BPF subsystem poses a high risk of local privilege escalation or system instability.

This is a double socket release vulnerability occurring within the bpf_iter_tcp_batch function. An attacker with local access can trigger this flaw during realloc failure, leading to a null pointer dereference and potential memory corruption via improper socket reference counting.

The vulnerability carries a CVSS score of 7.8, indicating a high severity level. Successful exploitation by a local, low-privileged user could result in complete system compromise through privilege escalation or cause a kernel panic leading to significant service disruption. Because this flaw resides in the core kernel, it impacts the stability and security of all dependent applications and services.

Immediate Action: Update the Linux kernel to version 6.18.42, 7.1.6, or 7.2 and later to incorporate the necessary memory management fixes.

Proactive Monitoring: Monitor system logs for kernel oops or null pointer dereference errors, particularly those involving BPF-related operations or socket diagnostics.

Compensating Controls: Restrict access to BPF functionality by setting the kernel.unprivileged_bpf_disabled sysctl to 1 to prevent unprivileged users from interacting with the vulnerable subsystem.

Public Exploit Available: Unknown.

Given the potential for local privilege escalation and the critical nature of kernel-level vulnerabilities, organizations should prioritize patching their Linux environments. Applying the official vendor kernels mentioned above is the only reliable method to eliminate this risk, as compensating controls like sysctl modifications only reduce the attack surface rather than fixing the underlying logical error.