A memory corruption vulnerability in the Linux kernel BPF subsystem could allow a local authenticated attacker to achieve code execution or system instability.

This is a stack-based memory corruption flaw occurring within the BPF x86 trampoline implementation. The vulnerability is triggered when processing 128-bit scalar arguments, as the kernel under-allocates the register save area, leading to an overwrite of adjacent stack slots by the save_args function.

The vulnerability carries a CVSS score of 7.8, indicating a high level of risk for local environments. A successful exploit could lead to full system compromise, including unauthorized access to sensitive data or permanent denial of service through kernel panic. Because this affects the core kernel, the potential for privilege escalation is significant, which could disrupt business operations and compromise the integrity of the entire host system.

Immediate Action: Apply the latest kernel patches from your distribution provider, ensuring the system is updated to at least 6.12.110, 6.18.52, or 7.2.6 depending on your active branch.

Proactive Monitoring: Monitor system logs for kernel oops, segmentation faults, or unexplained system crashes that may indicate an exploitation attempt targeting the BPF subsystem.

Compensating Controls: Restrict access to BPF-related system calls by non-privileged users, as this vulnerability requires local access to trigger.

Public Exploit Available: No

Given the severity of potential kernel-level exploitation, organizations should prioritize patching their Linux environments as part of the next maintenance cycle. System administrators should verify their kernel version and apply the upstream fixes provided by the Linux stable maintainers to eliminate this vector of memory corruption.