A race condition vulnerability in the Linux kernel BPF subsystem could allow a local authenticated attacker to achieve arbitrary code execution or system instability.

The flaw exists in the __bpf_get_stack function where preemption is not disabled during buffer operations. A local attacker with low privileges can exploit this to corrupt memory via an out of bounds write when a task is preempted and the per CPU buffer is reused by another task.

The vulnerability carries a CVSS score of 7.8, indicating a high severity risk. Successful exploitation allows a local user to escalate privileges or trigger a kernel panic, leading to full system compromise or denial of service. Such an event could result in significant downtime and the loss of data integrity for affected server environments.

Immediate Action: Update the Linux kernel to version 6.12.109, 6.18.50, 7.2.4, or later depending on the active branch.

Proactive Monitoring: Monitor system logs for kernel oops, segmentation faults, or unusual BPF program execution patterns that may indicate attempts to trigger memory corruption.

Compensating Controls: Restrict the ability of unprivileged users to load BPF programs by setting the kernel.unprivileged_bpf_disabled sysctl parameter to 1.

Public Exploit Available: No (exploit_available: false)

This vulnerability represents a significant risk to the stability and security of Linux environments. Administrators should prioritize patching the kernel across all affected production systems. Until updates can be applied, restricting access to BPF functionality is a prudent measure to reduce the attack surface for local users.