The vulnerability (CVE-2026-93148) concerns the Linux kernel's BPF subsystem where BTF struct walks relax struct-size checks for accesses through trailing flexible arrays. While this relaxation is valid for ordinary BTF type walking, it is not appropriate for MEM_ALLOC objects, which are allocated with the static BTF type size. The flaw allowed accesses beyond the allocated object bounds. The fix enforces rejecting accesses that extend past the struct size before applying flexible-array relaxation and applies the same bounds checking to struct ID matching for kfunc and kptr type checks, preventing out-of-bounds walks.

Exploitation of this vulnerability could allow a local attacker with limited privileges to perform out-of-bounds memory accesses within the kernel's BPF subsystem, potentially leading to privilege escalation or system compromise. The CVSS score of 7.8 reflects high impact on confidentiality, integrity, and availability.

A fix has been implemented in the Linux kernel to reject MEM_ALLOC BTF accesses that extend beyond object bounds. Users should apply the official kernel updates that include this patch. Since no explicit patch links or vendor advisory are provided here, users should consult their Linux distribution or kernel vendor for the updated kernel versions containing this fix.