The Linux kernel's BPF subsystem on x86 platforms had a vulnerability where the per-CPU address MOV instruction's destination register was incorrectly resolved due to improper handling of the REX prefix bits. Specifically, the REX.B bit was set instead of REX.R, causing the high register bit to be lost and the destination register to alias an incorrect low register. This led to kernel panics when the kernel attempted to dereference pointers that were never properly made per-CPU. The issue was particularly evident with BPF programs compiled with GCC, which maintain multiple per-CPU addresses live, unlike clang which reloads addresses into R1 before each access. The fix involved using add_2mod() to correctly set REX.R, aligning with how other instructions encode extended registers.

The vulnerability can cause kernel panics due to invalid pointer dereferences when BPF programs access per-CPU data using extended registers incorrectly resolved. This can lead to system instability and crashes. The impact is limited to BPF programs compiled with GCC that keep multiple per-CPU addresses live, as clang-based programs do not trigger this issue. There is no indication of remote exploitation or data leakage; the primary impact is local kernel stability.

A fix has been implemented in the Linux kernel source to correct the instruction encoding for per-CPU address MOV instructions by properly setting the REX.R bit instead of REX.B. Users should update to the fixed kernel version once available. No additional mitigation is indicated. Patch status is not explicitly confirmed in the provided data; check the vendor advisory or Linux kernel mailing lists for the official fix and updated kernel versions.