kernel/bpf/verifier.c in the Linux kernel 4.9.x through 4.9.71 does not
check the relationship between pointer values and the BPF stack, which
allows local users to cause a denial of service (integer overflow or
invalid memory access) or possibly have unspecified other impact.

Jann Horn discovered that the Berkeley Packet Filter (BPF) implementation
in the Linux kernel did not properly check the relationship between pointer
values and the BPF stack. A local attacker could use this to cause a denial
of service (system crash) or possibly execute arbitrary code.