The vulnerability in the Linux kernel's BPF (Berkeley Packet Filter) subsystem involved improper validation of the source pointer type during load-acquire atomic operations. Specifically, check_atomic_load() called check_load_mem() before atomic_ptr_type_ok(), which caused the source register's type to be overwritten and prevented atomic_ptr_type_ok() from rejecting disallowed pointer types such as ctx, pkt, flow_keys, and sock. This led to type confusion where raw kernel object memory could be accessed without proper conversion, exemplified by the sk field of struct __sk_buff being accessed as PTR_TO_SOCK_COMMON_OR_NULL but actually holding unconverted struct sk_buff bytes. The fix involved validating the source register with check_reg_arg() and rechecking the source pointer type with atomic_ptr_type_ok() before the load, mirroring the approach used in check_atomic_rmw(). Out-of-range register numbers are rejected earlier, preventing out-of-bounds reads. This vulnerability was resolved in a Linux kernel update.

The vulnerability allows type confusion in the kernel's BPF subsystem, potentially exposing raw kernel memory and enabling unauthorized access to kernel objects. This can lead to a compromise of confidentiality, integrity, and availability of the affected system. The CVSS score of 7.8 reflects high impact, requiring local privileges with low complexity and no user interaction.

A fix for this vulnerability is available in the Linux kernel. Users and administrators should apply the official kernel updates that include the patch resolving this issue. Since this is a kernel vulnerability, updating to the fixed kernel version is the recommended mitigation. No alternative mitigations are indicated.