Linux Kernel eBPF Verifier Boundary Evasion LPE

Critical vulnerability in the Linux kernel extended Berkeley Packet Filter (eBPF) verifier arithmetic logic allowing local unprivileged containers to break out and execute arbitrary kernel memory code.

When evaluating signed 64-bit bounds under conditional jump offsets with 32-bit register sub-slices, the eBPF verifier incorrectly deduces min/max pointer boundaries as non-overlapping. This mathematical desynchronization allows attackers to craft a malicious BPF program that passes safety validation but achieves out-of-bounds kernel memory read and write primitives at runtime.