A vulnerability in the Linux kernel BPF subsystem allows local attackers to bypass memory safety checks, potentially resulting in unauthorized memory access or system instability.

The vulnerability exists within the BPF verifier, which fails to enforce bounds on rdonly_buf_size and rdwr_buf_size kfunc arguments. This allows a local, authenticated attacker to trigger an integer truncation, causing the verifier to miscalculate memory register sizes and perform unsafe memory operations.

The flaw carries a CVSS score of 7.8, indicating a high severity. Successful exploitation by a local attacker could lead to full system compromise, including unauthorized data access, privilege escalation, or a kernel panic causing system denial of service. Because the kernel manages all system resources, this vulnerability represents a significant risk to the integrity and availability of the host environment.

Immediate Action: Update the Linux kernel to version 7.2.6 or later, or apply the upstream patches provided in the referenced git commits to ensure buffer sizes are correctly validated.

Proactive Monitoring: Monitor system logs for kernel-related faults or unexpected BPF program crashes that may indicate an attempt to trigger this integer truncation.

Compensating Controls: Restrict access to BPF functionality by limiting the CAP_BPF capability to trusted users, which effectively mitigates the attack vector for non-privileged users.

Public Exploit Available: Unknown

Given the potential for privilege escalation and the critical nature of the Linux kernel, organizations should prioritize updating their systems to the patched kernel version. If an immediate kernel update is not feasible, restricting user access to BPF subsystem operations is a necessary step to reduce the attack surface until a maintenance window can be scheduled.