The vulnerability in the Linux kernel's BPF subsystem was caused because the tracing_multi link did not set the ftrace_managed flag. This omission prevented the proper release of the tracing_multi link when both tracing_multi and fentry links were attached. The kernel logs showed warnings related to bpf_trampoline_multi_detach and bpf_link_release functions. The fix involved setting 'ftrace_managed = true' in the register_fentry_multi() function to ensure proper management and release of these links.

The vulnerability has a CVSS score of 7.8 (high severity) with impacts on confidentiality, integrity, and availability (C:H/I:H/A:H). It requires local access (AV:L) with low complexity (AC:L) and low privileges (PR:L) but no user interaction (UI:N). Exploitation could lead to significant kernel-level issues affecting system stability and security. No known exploits in the wild have been reported.

A fix is available that sets the ftrace_managed flag in the register_fentry_multi() function to properly manage tracing_multi trampolines. Users should apply the official Linux kernel patches that include this fix. Since no cloud service is involved, manual patching of affected Linux kernel versions is required. Patch status is confirmed by the vendor advisory describing the fix.