The vulnerability involves the Linux kernel's BPF verifier failing to verify consistency of underlying base IDs when comparing scalar registers that carry the BPF_ADD_CONST flag. The verifier's idmap created independent entries for compound IDs without ensuring the base IDs were consistent, allowing construction of conflicting verifier states that passed pruning incorrectly. The patch adds a check to verify base ID mapping consistency after mapping compound IDs, ensuring that any ADD_CONST derivative must derive from the same base ID as the source register, thus preventing inconsistent verifier states.

This vulnerability could allow an attacker with limited privileges (local access with low privileges) to cause inconsistent BPF verifier states, potentially leading to incorrect verification outcomes. The CVSS vector indicates low attack complexity and privileges required, with no user interaction needed, and high impact on confidentiality, integrity, and availability. However, no known exploits in the wild have been reported.

A fix is available for this vulnerability in Linux kernel versions 7.0.0-28.28.1 and later. Users should upgrade to a patched kernel version to remediate the issue. Since this is a kernel-level vulnerability, applying the official kernel update from the vendor is the recommended mitigation.