The vulnerability in the Linux kernel's BPF (Berkeley Packet Filter) implementation was caused by holding the per-VMA lock across the BPF program body, creating a lock ordering problem involving vm_lock, i_rwsem, mmap_lock, and vm_lock again. This could lead to deadlocks or inconsistent memory state. The fix snapshots the VMA under the per-VMA lock using memcpy() in the _next() function, then drops the lock before returning. The BPF program accesses only this snapshot. The verifier trusts only vm_mm and vm_file pointers, which are properly reference counted and verified under the lock. Other pointers copied by memcpy() are treated as untrusted by the verifier, preventing unsafe access.

This vulnerability could cause kernel lock ordering issues, potentially leading to deadlocks or memory corruption in the BPF subsystem. Such issues may affect system stability or security when running BPF programs. No known exploits in the wild have been reported. The impact is limited to affected Linux kernel versions prior to 7.0.0-28.28.1 in the linux-hwe-edge line.

An official fix is available in Linux kernel versions 7.0.0-28.28.1 and later for the linux-hwe-edge product. Users should update to these fixed versions to remediate the vulnerability. No additional mitigation steps are indicated by the vendor advisory.