The BPF interpreter fails to validate the register index when loading or storing values from or to a scratch memory register. While the index is an unsigned 32-bit integer that should not exceed 15, the lack of validation allows a crafted filter program to force reads and writes into process memory outside intended bounds. On 64-bit architectures, this can affect the 16GiB of memory starting at the current stack frame, and on 32-bit architectures, it can affect the entire address space.