A high-severity use-after-free vulnerability in the Linux kernel BPF filesystem creates a risk of system instability for local users.

This is a use-after-free vulnerability caused by improper inode cleanup within the bpffs component. The issue occurs when an inode is freed while another process is still accessing its path, which can be triggered by a local attacker via a concurrent unlinkat() operation.

The vulnerability is rated at 7.8 on the CVSS scale. While exploitation requires local access, the ability to trigger a kernel crash or memory corruption in the BPF subsystem can lead to significant service downtime and potential instability in environments relying on BPF for networking or observability.

Immediate Action: Update the Linux kernel to version 5.15.212, 6.1.178, 6.6.145, 6.12.97, or later.

Proactive Monitoring: Monitor system logs for kernel-level errors or stack traces related to bpffs or inode handling.

Compensating Controls: Restrict access to BPF-related system calls to privileged users only, where possible, to prevent unauthorized triggering of the vulnerability.

Public Exploit Available: false

Organizations should patch their Linux systems to the recommended versions to eliminate this memory safety issue. Prioritize systems where untrusted local users have access to BPF-related functionality or where high uptime is required for BPF-dependent services.