The Linux kernel's BPF verifier function check_alu_op() previously used an incorrect check 'insn->off > 1' to validate the offset field of ALU operation instructions, which is a signed 16-bit integer. Because the offset is signed, negative values such as -1 were incorrectly accepted, allowing malformed BPF programs to pass verification. The fix changes the condition to '(insn->off != 0 && insn->off != 1)', ensuring only offsets 0 and 1 are accepted, thereby hardening the verifier against malformed inputs.

This vulnerability could allow an attacker with limited privileges to load crafted BPF programs that bypass verification checks, potentially leading to arbitrary code execution or kernel memory corruption. The CVSS vector indicates local attack complexity and privileges required, but with high impact on confidentiality, integrity, and availability of the system.

A fix has been implemented in the Linux kernel to correct the offset validation logic in the BPF verifier. Users should update their Linux kernel to a version that includes this fix. Since this is a kernel vulnerability, patching the kernel is the recommended remediation. No alternative mitigations are indicated.