The Linux kernel contained a vulnerability in its BPF subsystem where the function check_ptr_to_btf_access() allowed program-type btf_struct_access callbacks to validate write operations before the default BTF access path enforced a read-only policy on untrusted BTF pointers. This flaw enabled bypassing the read-only restriction on untrusted pointers created by helpers like bpf_rdonly_cast(), potentially allowing unauthorized writes. The vulnerability was addressed by rejecting all non-read accesses through PTR_UNTRUSTED BTF pointers at a common entry point prior to callback handling.

This vulnerability could allow a local attacker with limited privileges to perform unauthorized write operations through untrusted BTF pointers in the Linux kernel's BPF subsystem. The CVSS score of 7.8 indicates high severity with potential impacts on confidentiality, integrity, and availability. Exploitation could lead to privilege escalation or kernel memory corruption. However, no known exploits in the wild have been reported.

A fix for this vulnerability has been implemented in the Linux kernel. Users and administrators should apply the official kernel updates that include this patch to ensure the vulnerability is remediated. Since this is not a cloud service, manual patching is required. Patch status is not explicitly provided in the input; therefore, check the vendor advisory for the latest remediation guidance and apply the official fix as soon as it is available.