A vulnerability in the Linux kernel BPF subsystem allows a local authenticated attacker to achieve elevated privileges or conduct unauthorized memory operations due to improper pointer state preservation.

This is a memory corruption vulnerability located in the BPF arithmetic verification logic. When performing scalar arithmetic on pointers, the kernel fails to correctly preserve pointer provenance, which can be exploited by an attacker with local, low-privileged access to corrupt kernel memory.

The ability for a local attacker to manipulate kernel memory poses a severe risk to system integrity and confidentiality. Successful exploitation typically results in full system compromise, including the ability to bypass security controls, escalate privileges to root, or execute arbitrary code at the kernel level. While the CVSS score is 7.8, the potential for kernel-level execution makes this a critical priority for systems where untrusted local users have shell access.

Immediate Action: Apply the latest security updates provided by your Linux distribution, ensuring the kernel is updated to at least version 5.10.265, 5.15.216, 6.1.183, or 6.6.152.

Proactive Monitoring: Monitor system logs for unexpected kernel oops, crashes, or unauthorized attempts to load BPF programs, which may indicate exploitation attempts.

Compensating Controls: Restrict access to BPF functionality by setting the kernel.unprivileged_bpf_disabled sysctl parameter to 1 to prevent unprivileged users from loading BPF programs.

Public Exploit Available: Unknown

Given the potential for local privilege escalation and kernel memory corruption, organizations should treat this vulnerability with high urgency. Administrators must prioritize patching the kernel across all Linux environments, particularly on multi-user systems or container hosts where BPF features are enabled for unprivileged users. Applying the vendor-provided security patches is the only reliable way to mitigate this risk.