The Linux kernel vulnerability involves the BPF subsystem where freplace uprobe programs, which share the actual program type KPROBE, could abuse the kprobe_write_ctx mechanism to modify the struct pt_regs of kernel functions. This allowed a freplace_kprobe program to alter the first argument of a kernel function to zero when attached via kprobe+freplace. The fix prevents this abuse by disallowing freplace programs from attaching to kprobe programs if their kprobe_write_ctx values differ, thereby protecting kernel function argument integrity.

An attacker with high privileges (PR:H) could exploit this vulnerability to modify kernel function arguments, potentially leading to unintended kernel behavior or privilege escalation within the kernel context. The vulnerability requires local access (AV:L) and low attack complexity (AC:L), but no user interaction. The impact on confidentiality, integrity, and availability is high (VC:H, VI:H, VA:H).

A fix is available in Linux kernel versions 7.0.0-28.28.1 and later, which disallows attaching freplace programs on kprobe programs with different kprobe_write_ctx values. Users should upgrade to a patched kernel version to remediate this vulnerability. Patch status is confirmed by the affectedVersions field indicating versions prior to 7.0.0-28.28.1 are vulnerable.