A vulnerability in the Linux kernel BPF verifier enables local users to achieve potential privilege escalation or system crashes via out-of-bounds memory access.

The vulnerability exists in the BPF verifier, where improper management of scalar IDs during sign-extending loads causes registers to share incorrect state information. An attacker with local access can exploit this state confusion to trick the verifier into permitting out-of-bounds memory access.

Successful exploitation of this vulnerability allows a local, authenticated attacker to gain unauthorized access to kernel memory, potentially leading to privilege escalation or a kernel panic. Given the CVSS score of 7.8, this flaw presents a significant risk to system integrity and availability, particularly in multi-tenant environments where local user isolation is critical.

Immediate Action: Apply the vendor-provided kernel patch by updating the Linux kernel to version 7.2.6 or later.

Proactive Monitoring: Monitor system logs for kernel panics or unexpected segmentation faults that may indicate attempts to trigger memory corruption.

Compensating Controls: Restrict access to eBPF functionality by setting the sysctl parameter kernel.unprivileged_bpf_disabled to 1 to prevent non-privileged users from loading BPF programs.

Public Exploit Available: Unknown

This high-severity vulnerability requires immediate attention for any systems running affected Linux kernel versions. Administrators should prioritize patching the kernel to version 7.2.6 or above. If immediate patching is not feasible, disabling unprivileged BPF access is a highly effective mitigation to reduce the attack surface for local users.