A high-severity use-after-free vulnerability in the Linux kernel BPF subsystem could allow a local authenticated attacker to achieve code execution or system instability.

This is a use-after-free flaw in the BPF verifier where RCU pointers remain valid after a spin lock is released. A local user with limited privileges can exploit this to access freed memory, such as a task_struct, leading to potential privilege escalation or kernel panic.

The vulnerability carries a CVSS score of 7.8, reflecting its high impact on system integrity, confidentiality, and availability. Because this flaw resides in the kernel, a successful exploit could grant an attacker full control over the compromised host. This poses a significant risk to the stability of enterprise infrastructure and the security of sensitive data stored on affected systems.

Immediate Action: Update the Linux kernel to version 7.2.6 or later to incorporate the necessary RCU pointer validation logic.

Proactive Monitoring: Monitor kernel logs for recurring stability issues or unexpected segmentation faults that may indicate failed exploitation attempts.

Compensating Controls: Restrict access to BPF functionality by limiting the CAP_BPF capability to trusted users, which serves as a primary defense against unprivileged exploitation.

Public Exploit Available: Unknown.

Given the potential for privilege escalation and the critical nature of kernel-level vulnerabilities, administrators should prioritize updating to the patched kernel version 7.2.6. Organizations that cannot immediately reboot for kernel updates should evaluate the impact of restricting non-privileged access to the BPF subsystem as a temporary defense measure.