The vulnerability in the Linux kernel's BPF subsystem arises because bpf_arena_free_pages() accepts scalar arena addresses and reconstructs full user addresses by masking to low 32 bits and adding the arena base. If the scalar value is below the low 32 bits of the arena base, the reconstructed full user address falls below user_vm_start. The existing clipping logic then produces an out-of-range free-tree offset. Subsequent allocations can reuse this offset, returning addresses below the arena mapping, which can cause memory corruption. The fix involves rejecting such frees before computing the clipped range.

This vulnerability can lead to memory corruption by allowing allocations to return addresses outside the intended arena mapping. This can compromise confidentiality, integrity, and availability of the system, as indicated by the CVSS vector (Confidentiality: High, Integrity: High, Availability: High).

No explicit patch or remediation details are provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.