A memory corruption vulnerability in the Linux kernel BPF subsystem poses a high risk of privilege escalation or system instability for local users.

The vulnerability exists in the bpf_arena_free_pages function, which fails to properly validate scalar arena addresses. A local authenticated attacker can supply a value below the arena base, resulting in an out-of-range memory operation that allows subsequent allocations to return addresses outside the intended arena mapping.

The CVSS score of 7.8 indicates a high-severity risk despite requiring local access. Successful exploitation could allow a low-privileged user to corrupt kernel memory, potentially leading to full system compromise, data exfiltration, or denial of service through kernel panics. Organizations relying on Linux-based container hosts or multi-tenant environments face the highest risk of lateral movement or sandbox escape.

Immediate Action: Update the Linux kernel to version 6.12.110, 6.18.52, 7.2.6, or a later stable release provided by your distribution vendor.

Proactive Monitoring: Monitor system logs for kernel oops or unexpected segmentation faults related to BPF programs, which may indicate attempted exploitation.

Compensating Controls: Restrict access to BPF functionality by limiting the CAP_BPF capability to trusted users and processes, which can effectively prevent unprivileged exploitation of this flaw.

Public Exploit Available: Unknown

Given the potential for privilege escalation and the critical nature of kernel memory management, organizations should prioritize patching this vulnerability in all production environments. System administrators should verify their kernel version against the fixed releases and apply kernel updates as part of the next maintenance cycle to ensure system stability and security.