The vulnerability (CVE-2026-53095) in the Linux kernel's BPF subsystem arises because uprobe programs, which are actually of type KPROBE, can modify the struct pt_regs when combined with freplace programs. This allows a freplace_kprobe program to attach to a kprobe program, which itself attaches to a kernel function, and forcibly modify the first argument of that kernel function to zero. The root cause is the abuse of the kprobe_write_ctx feature via kprobe+freplace. The fix involves disallowing freplace programs from attaching to kprobe programs if their kprobe_write_ctx values differ, preventing this manipulation.

The vulnerability can cause kernel functions to receive manipulated arguments, specifically forcing the first argument to zero, which could lead to denial of service or other unintended kernel behavior. The CVSS score is 5.5 (medium severity) with an attack vector requiring local access, low complexity, and privileges. There is no confidentiality or integrity impact, but availability impact is high.

The vulnerability has been resolved in the Linux kernel by disallowing freplace programs from attaching to kprobe programs with different kprobe_write_ctx values. No specific patch versions are provided in the data. Users should apply the official Linux kernel updates that include this fix once available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.