Linux Kernel EUVD-2026-32251

The affected code resides in the Linux kernel BPF subsystem's instruction array map implementation (cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*). BPF programs can reference map values directly via LD_IMM64 pseudo-instructions; resolve_pseudo_ldimm64() resolves these at load time by calling map_direct_value_addr() to obtain the base address and then adding the requested offset. The bug is that map_direct_value_addr() for the instruction array map also adds the offset itself, causing a double-application of the offset. This is an off-by-offset logic error - effectively an incorrect pointer arithmetic issue - rather than a classic CWE-classified weakness (CWE is listed as N/A). The resulting stale or out-of-bounds address can cause the kernel to access invalid memory, leading to a kernel panic or oops (Availability: High). The metadata tags also flag 'Information Disclosure,' which is plausible if the wrong memory address resolves to readable kernel data rather than faulting, though the supplied CVSS vector specifies C:N - this conflict is unresolved in the available data.