CVE-2021-46974

bpf: Fix masking negation logic upon negative dst register

State: Published
Severity: 7.1 High
Published: Feb 27, 2024
Updated: Aug 5, 2026
Reserved: Feb 27, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix masking negation logic upon negative dst register

The negation logic for the case where the off_reg is sitting in the dst register is not correct given then we cannot just invert the add to a sub or vice versa. As a fix, perform the final bitwise and-op unconditionally into AX from the off_reg, then move the pointer from the src to dst and finally use AX as the source for the original pointer arithmetic operation such that the inversion yields a correct result. The single non-AX mov in between is possible given constant blinding is retaining it as it's not an immediate based operation.

Scores

CVSS	Score	Vector	Source
3.1	7.1 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	ae03b6b1c880a03d4771257336dc3bca156dd51b to before 4d542ddb88fb2f39bf7f14caa2902f3e8d06f6baAffected f92a819b4cbef8c9527d9797110544b2055a4b96 to before 0e2dfdc74a7f4036127356d42ea59388f153f42cAffected 979d63d50c0c0f7bc537bf821e056cc9fe5abd38 to before 53e0db429b37a32b8fc706d0d90eb4583ad13848Affected 979d63d50c0c0f7bc537bf821e056cc9fe5abd38 to before 2cfa537674cd1051a3b8111536d77d0558f33d5dAffected 979d63d50c0c0f7bc537bf821e056cc9fe5abd38 to before 6eba92a4d4be8feb4dc33976abac544fa99d6eccAffected 979d63d50c0c0f7bc537bf821e056cc9fe5abd38 to before 7cf64d8679ca1cb20cf57d6a88bfee79a0922a66Affected 979d63d50c0c0f7bc537bf821e056cc9fe5abd38 to before b9b34ddbe2076ade359cd5ce7537d5ed019e9807Affected 078da99d449f64ca04d459cdbdcce513b64173cdAffected 4.14.113 to before 4.14.233Affected 4.19.19 to before 4.19.190Affected 4.20.6 to before 4.21Affected
LinuxLinux	5.0Affected before 5.0Not affected 4.14.233 through 4.14.Not affected 4.19.190 through 4.19.Not affected 5.4.117 through 5.4.Not affected 5.10.35 through 5.10.Not affected 5.11.19 through 5.11.Not affected 5.12.2 through 5.12.Not affected 5.13 and laterNot affected

Product

Versions

LinuxLinux

ae03b6b1c880a03d4771257336dc3bca156dd51b to before 4d542ddb88fb2f39bf7f14caa2902f3e8d06f6baAffected
f92a819b4cbef8c9527d9797110544b2055a4b96 to before 0e2dfdc74a7f4036127356d42ea59388f153f42cAffected
979d63d50c0c0f7bc537bf821e056cc9fe5abd38 to before 53e0db429b37a32b8fc706d0d90eb4583ad13848Affected
979d63d50c0c0f7bc537bf821e056cc9fe5abd38 to before 2cfa537674cd1051a3b8111536d77d0558f33d5dAffected
979d63d50c0c0f7bc537bf821e056cc9fe5abd38 to before 6eba92a4d4be8feb4dc33976abac544fa99d6eccAffected
979d63d50c0c0f7bc537bf821e056cc9fe5abd38 to before 7cf64d8679ca1cb20cf57d6a88bfee79a0922a66Affected
979d63d50c0c0f7bc537bf821e056cc9fe5abd38 to before b9b34ddbe2076ade359cd5ce7537d5ed019e9807Affected
078da99d449f64ca04d459cdbdcce513b64173cdAffected
4.14.113 to before 4.14.233Affected
4.19.19 to before 4.19.190Affected
4.20.6 to before 4.21Affected

LinuxLinux

5.0Affected
before 5.0Not affected
4.14.233 through 4.14.*Not affected
4.19.190 through 4.19.*Not affected
5.4.117 through 5.4.*Not affected
5.10.35 through 5.10.*Not affected
5.11.19 through 5.11.*Not affected
5.12.2 through 5.12.*Not affected
5.13 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.