The vulnerability in the Linux kernel's BPF subsystem involves the handling of exclusive maps (created with excl_prog_hash) used as inner maps in map-in-map structures. Normally, exclusive maps are bound to a single program by a hash check (check_map_prog_compatibility) that ensures only programs with matching digests can load the map. However, this check only applies to maps directly referenced by a program (used_maps). Maps accessed at runtime through map-of-maps are not included in used_maps, and the bpf_map_meta_equal() function does not consider the exclusive program hash (excl_prog_sha). Consequently, an exclusive map can be inserted into a non-exclusive outer map and then accessed and mutated by an unrelated program, bypassing the exclusivity guarantee. This also defeats the signed loader's metadata map exclusivity check, allowing a hostile program to rewrite the frozen map's contents through the outer map. The vulnerability has been resolved in the Linux kernel.

The vulnerability allows unrelated programs to bypass exclusivity guarantees on exclusive BPF maps by inserting them into non-exclusive outer maps and mutating their contents. This undermines the integrity and exclusivity of BPF maps, potentially allowing unauthorized modification of kernel data structures or bypassing security checks enforced by exclusive maps. The signed loader's metadata map exclusivity check can also be circumvented, increasing the risk of unauthorized map content modification.

A fix for this vulnerability has been implemented in the Linux kernel. Users and administrators should update to the fixed kernel versions once available. Patch status is not yet confirmed in the provided data — check the official Linux kernel advisories or vendor advisories for the current remediation guidance and apply the official fix when released.