The vulnerability in the Linux kernel's BPF subsystem involves the open-coded task_vma iterator accessing task->mm without calling mmget(), leading to a use-after-free condition if the task exits concurrently. This is due to the mm_struct not being SLAB_TYPESAFE_BY_RCU and the lack of proper reference counting. The fix applies a trylock on alloc_lock to safely read task->mm and acquires an mm reference, releasing it asynchronously in cleanup paths. The fix also rejects execution in irqs-disabled contexts to prevent deadlocks. This vulnerability affects Linux kernel versions before 7.0.0-28.28.1.

If exploited, this vulnerability could cause use-after-free conditions in the kernel, potentially leading to kernel crashes or arbitrary code execution with elevated privileges. The CVSS vector indicates local attack vector with low complexity, requiring privileged access, no user interaction, and high impact on confidentiality, integrity, and availability. However, no known exploits are reported in the wild.

A fix is available in Linux kernel versions 7.0.0-28.28.1 and later. Users should update to these or newer kernel versions to remediate the vulnerability. Since this is not a cloud service, manual patching is required. There are no vendor advisories indicating no action is required or that the issue is already mitigated without patching.