A vulnerability in the Linux kernel BPF subsystem allows an authenticated local attacker to corrupt memory by writing to restricted cpumask pointers, necessitating an immediate kernel update.

The bpf_cpumask_populate function incorrectly accepts borrowed, read-only cpumask pointers as writable destinations due to improper type validation in the BPF verifier. This enables a local user with low privileges to trigger memory corruption or state inconsistency by treating read-only structures as mutable.

While the CVSS score of 7.1 indicates a high severity, the impact is constrained by the requirement for local access. Successful exploitation allows a local user to achieve significant impacts on system integrity and availability, such as causing kernel panics or bypassing security policy enforcement mechanisms managed by BPF programs. This represents a substantial risk for multi-tenant environments or systems where untrusted users possess local shell access.

Immediate Action: Update the Linux kernel to version 6.18.52, 7.2.6, or later, as provided by your distribution vendor.

Proactive Monitoring: Monitor system logs for kernel oops, unexpected panics, or BPF-related verifier errors that may indicate exploitation attempts.

Compensating Controls: Restrict access to BPF functionality by setting the kernel.unprivileged_bpf_disabled sysctl value to 1 to prevent non-privileged users from loading BPF programs.

Public Exploit Available: No

This vulnerability highlights the ongoing security challenges associated with the BPF subsystem and the importance of strictly controlling BPF program loading in production environments. Administrators should prioritize patching the kernel to the recommended stable releases to prevent local privilege escalation or denial of service. If immediate patching is not feasible, enforcing the unprivileged BPF restriction is a highly effective measure to reduce the attack surface.