A high-severity vulnerability in the Linux kernel allows authenticated local users to cause a denial of service or kernel panic by exploiting improper BPF program validation.

This is a BPF verifier flaw where sleepable BPF_LSM_CGROUP programs are not correctly rejected at load time. A local attacker with CAP_BPF or CAP_SYS_ADMIN capabilities can trigger a kernel panic because these programs are executed within a context that prohibits sleeping operations.

The vulnerability carries a CVSS score of 7.8, indicating a high risk to system stability and availability. Successful exploitation allows a local user to crash the host kernel, resulting in unexpected system downtime. While exploitation requires specific local privileges, the potential for persistent service disruption poses a significant threat to critical infrastructure relying on affected Linux distributions.

Immediate Action: Update the Linux kernel to version 7.1.5 or apply the upstream commits be9eaf2bb5db4ad3de61ef739fd268fd7f135737 and 5b038319be442c620f774e6fc9e9283deeca1c75.

Proactive Monitoring: Monitor system logs for kernel oops messages or sudden service restarts that may indicate attempted exploitation of the BPF verifier.

Compensating Controls: Restrict access to BPF-related capabilities, such as CAP_BPF and CAP_SYS_ADMIN, to only those users and processes that strictly require them for administrative tasks.

Public Exploit Available: No (Exploit_available: false)

Given the potential for system-wide instability, administrators should prioritize updating kernel packages to the fixed version 7.1.5. If immediate patching is not feasible, enforce strict least-privilege access controls to limit the number of users capable of loading BPF programs, effectively mitigating the attack vector.