The vulnerability in the Linux kernel's BPF subsystem concerns ARRAY_OF_MAPS that use an inner map template created with BPF_F_INNER_MAP. A concrete inner array with a different max_entries value can replace this template. The verifier previously represented the lookup result using the template's max_entries, causing const-key lookup nullness elision to assume keys were in bounds incorrectly. The runtime helper, however, uses the concrete inner map's max_entries, which may differ. The fix prevents nullness elision for maps marked with BPF_F_INNER_MAP, ensuring key bounds are correctly validated against the concrete map at runtime.

This vulnerability could cause the kernel to incorrectly assume that certain keys are valid during BPF map lookups, potentially leading to out-of-bounds accesses or other logic errors in BPF programs that rely on ARRAY_OF_MAPS with dynamic inner arrays. No known exploits are reported in the wild. The impact is limited to BPF programs using this specific feature and depends on the difference between template and concrete inner map sizes.

A fix has been implemented in the Linux kernel to address this issue. Since this is a kernel vulnerability, updating to a kernel version that includes this fix is the recommended mitigation. Patch status is not explicitly stated in the provided data; therefore, check the official Linux kernel advisories or vendor patches for the specific fixed versions. No additional mitigation steps are indicated.