A use-after-free vulnerability in the Linux kernel BPF subsystem poses a high risk of local privilege escalation or system crashes due to improper socket cloning memory management.

The vulnerability occurs during socket cloning when the kernel fails to properly reset the BPF local storage pointer before early bailouts. This leads to a use-after-free condition on the parent socket when the cloned socket is destroyed, requiring an authenticated local user to trigger the flaw.

Successful exploitation of this vulnerability allows a local, authenticated attacker to gain unauthorized control over kernel memory, potentially leading to privilege escalation or a complete system denial of service. With a CVSS score of 7.8, the vulnerability is classified as high severity, as it directly impacts the confidentiality, integrity, and availability of the host operating system. Organizations running Linux kernels within the affected range face significant risk, particularly in multi-tenant or shared-hosting environments where local user isolation is critical.

Immediate Action: Update the Linux kernel to version 7.1.6 or later, or apply the upstream patches provided by the Linux stable maintainers.

Proactive Monitoring: Monitor system logs for kernel panic events or unusual memory-related errors that may indicate failed exploitation attempts or system instability.

Compensating Controls: Implement strict access control policies to limit the number of users with local shell access, thereby reducing the attack surface for local-only vulnerabilities.

Public Exploit Available: No

The severity of this vulnerability necessitates immediate attention, particularly for systems supporting local user access. Security teams should prioritize patching the kernel to version 7.1.6 or higher to eliminate the underlying use-after-free condition. In environments where immediate patching is not feasible, administrators should restrict local access to trusted users only to mitigate the risk of exploitation.