The Linux kernel BPF subsystem had a vulnerability in maybe_fork_scalars() where for BPF_OR operations with a source operand constant and a destination scalar with signed range [-1, 0], the verifier state was forked incorrectly. The pushed verifier path assumed dst=0, but the runtime value could be K, causing a divergence between verifier and runtime states. This discrepancy allows an attacker to exploit out-of-bounds map access. The fix involves changing the instruction index passed to push_stack() so the pushed path re-executes the ALU instruction correctly, ensuring accurate result computation for all opcodes. This vulnerability affects multiple Linux kernel versions prior to 6.8.0 and its variants.

Successful exploitation could lead to out-of-bounds map access, potentially allowing an attacker with local privileges to compromise system confidentiality, integrity, and availability. The CVSS 3.1 base score of 7.8 reflects high severity with local attack vector, low attack complexity, requiring privileges but no user interaction, and impacts on confidentiality, integrity, and availability.

A patch is available and should be applied promptly. The vendor advisory from Ubuntu confirms that this vulnerability is fixed in Linux kernel versions 6.8.0 and later (including specific patched builds). Users should update their systems to the fixed kernel versions listed in the advisory. After updating, a system reboot is required to apply the changes. Additionally, due to an ABI change, third-party kernel modules must be recompiled and reinstalled. No other specific mitigations are indicated by the vendor advisory.