A memory corruption flaw in the Linux kernel BPF bloom filter on 32-bit systems may allow a local authenticated attacker to achieve unauthorized memory access or system instability.

The bloom_map_alloc function performs incorrect 32-bit arithmetic when calculating bitmap sizes, leading to insufficient memory allocation and subsequent out-of-bounds writes. Additionally, signed integer handling of hash offsets on 32-bit kernels can result in negative bit offsets, allowing an authenticated local attacker to read or write memory outside the intended buffer.

The vulnerability carries a CVSS score of 7.8, indicating high severity. Successful exploitation requires local access, but it could lead to full system compromise, escalation of privileges, or persistent denial of service. For environments running sensitive 32-bit kernel workloads, this represents a significant risk to data integrity and system availability.

Immediate Action: Update the Linux kernel to version 6.1.188, 6.6.157, 6.12.109, or 6.18.50, as these versions contain the necessary hardening fixes.

Proactive Monitoring: Monitor system logs for kernel panic events or unusual memory management exceptions that could indicate failed exploitation attempts.

Compensating Controls: Restrict access to eBPF functionality by setting kernel.unprivileged_bpf_disabled to 1, which prevents unprivileged users from loading BPF programs and significantly reduces the attack surface.

Public Exploit Available: Unknown

Given the potential for privilege escalation and kernel-level memory corruption, administrators managing 32-bit Linux environments should prioritize patching as part of their next maintenance cycle. Applying the recommended kernel updates is the only definitive way to resolve the underlying arithmetic and memory handling errors.