An integer overflow in the BPF subsystem can allow an out-of-bounds write when many elements are placed in a hash's bucket.