The vulnerability in the Linux kernel's BPF subsystem arises from insufficient validation of repeated field counts in user-supplied BTF data during BPF_BTF_LOAD. Specifically, btf_parse_struct_metas() and btf_repeat_fields() functions handle repeated fields by expanding them into a fixed-size scratch array. The calculation of the expanded field count uses 32-bit unsigned arithmetic, which can overflow and cause the capacity check to incorrectly pass. This leads to a subsequent memcpy() writing beyond the bounds of the scratch array, resulting in a potential out-of-bounds write. The patch addresses this by performing checked addition and multiplication to detect overflow and rejecting malformed BTF data with impossible counts.

A malformed BTF input can trigger an out-of-bounds write in kernel memory during BPF program loading. This could potentially lead to kernel memory corruption, causing system instability or enabling privilege escalation. However, no known exploits are reported in the wild at this time.

A fix has been implemented in the Linux kernel to address this vulnerability by validating repeated field counts with checked arithmetic and rejecting malformed BTF data. Users should apply the official kernel updates containing this patch once available. Since this is not a cloud service, remediation depends on applying the vendor's kernel patch. Patch status is not yet confirmed in the provided data; check the vendor advisory for current remediation guidance.