The Linux kernel's bpf subsystem had two 32-bit-specific bugs in bloom_map_alloc(): an arithmetic overflow caused under-allocation of the bloom filter bitmap, and improper handling of bit offsets led to negative indexing in test_bit() calls. These flaws allowed writes beyond allocated memory, enabling local privilege escalation on 32-bit x86 kernels from processes with CAP_BPF. The fix involves computing bitset size using 64-bit arithmetic and splitting hashes into word pointers and in-word bit numbers to ensure safe bit operations.

The vulnerability allows local attackers with CAP_BPF capability on 32-bit x86 Linux kernels to perform out-of-bounds writes in kernel memory, potentially leading to local privilege escalation. This could enable attackers to gain elevated privileges on affected systems.

A fix has been implemented in the Linux kernel to correct bloom filter sizing and indexing on 32-bit kernels. Users should apply the official kernel updates that include this patch. Since this is a kernel vulnerability, updating to a patched kernel version is the recommended mitigation.