CVE-2024-58237bpf: consider that tail calls invalidate packet pointers
Updated under an hour ago ()
Does this affect you?
It affects Linux and 1 other product. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: bpf: consider that tail calls invalidate packet pointers Tail-called programs could execute any of the helpers that invalidate packet pointers. Hence, conservatively assume that each tail call invalidates packet pointers. Making the change in bpf_helper_changes_pkt_data() automatically makes use of check_cfg() logic that computes 'changes_pkt_data' effect for global sub-programs, such that the following program could be rejected: int tail_call(struct __sk_buff *sk) { bpf_tail_call_static(sk, &jmp_table, 0); return 0; } SEC("tc") int not_safe(struct __sk_buff *sk) { int *p = (void *)(long)sk->data; ... make p valid ... tail_call(sk); *p = 42; /* this is unsafe */ ... } The tc_bpf2bpf.c:subprog_tc() needs change: mark it as a function that can invalidate packet pointers. Otherwise, it can't be freplaced with tailcall_freplace.c:entry_freplace() that does a tail call.
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Modified
- Record last updated
- Oct 15, 2026
- First seen by InfoSec Signals
- Oct 15, 2026
Affected products
Linux Linux linux:linux (from the name) | from 51c39bb1d5d105a02e29aa7960f0a395086e6342 before f1692ee23dcaaddc24ba407b269707ee5df1301f; 51c39bb1d5d105a02e29aa7960f0a395086e6342 builds before 1c2244437f9ad3dd91215f920401a14f2542dbfc; 51c39bb1d5d105a02e29aa7960f0a395086e6342 builds before 1a4607ffba35bf2a630aab299e34dd3f6e658d70 | CNA record |
linux linux_kernel linux:linux_kernel | from 5.6 before 6.6.90; from 6.7 before 6.12.9; 6.13; 6.13 | NVD |
References
- https://git.kernel.org/stable/c/f1692ee23dcaaddc24ba407b269707ee5df1301fpatch
- https://git.kernel.org/stable/c/1c2244437f9ad3dd91215f920401a14f2542dbfcpatch
- https://git.kernel.org/stable/c/1a4607ffba35bf2a630aab299e34dd3f6e658d70patch
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.