kernel/bpf/verifier.c in the Linux kernel through 4.14.8 allows local users to cause a denial of service (integer overflow and memory corruption) or possibly have unspecified other impact by leveraging unrestricted integer values for pointer arithmetic.
https://github.com/torvalds/linux/commit/bb7f0f989ca7de1153bd128a40a71709e339fa03