CVE-2024-26591

bpf: Fix re-attachment branch in bpf_tracing_prog_attach

State: Published
Severity: Not scored
Published: Feb 22, 2024
Updated: May 11, 2026
Reserved: Feb 19, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix re-attachment branch in bpf_tracing_prog_attach

The following case can cause a crash due to missing attach_btf:

1) load rawtp program 2) load fentry program with rawtp as target_fd 3) create tracing link for fentry program with target_fd = 0 4) repeat 3

In the end we have:

- prog->aux->dst_trampoline == NULL - tgt_prog == NULL (because we did not provide target_fd to link_create) - prog->aux->attach_btf == NULL (the program was loaded with attach_prog_fd=X) - the program was loaded for tgt_prog but we have no way to find out which one

BUG: kernel NULL pointer dereference, address: 0000000000000058 Call Trace: <TASK> ? __die+0x20/0x70 ? page_fault_oops+0x15b/0x430 ? fixup_exception+0x22/0x330 ? exc_page_fault+0x6f/0x170 ? asm_exc_page_fault+0x22/0x30 ? bpf_tracing_prog_attach+0x279/0x560 ? btf_obj_id+0x5/0x10 bpf_tracing_prog_attach+0x439/0x560 __sys_bpf+0x1cf4/0x2de0 __x64_sys_bpf+0x1c/0x30 do_syscall_64+0x41/0xf0 entry_SYSCALL_64_after_hwframe+0x6e/0x76

Return -EINVAL in this situation.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	f3a95075549e0e5c36db922caf86847db7a35403 to before a7b98aa10f895e2569403896f2d19b73b6c95653Affected f3a95075549e0e5c36db922caf86847db7a35403 to before 6cc9c0af0aa06f781fa515a1734b1a4239dfd2c0Affected f3a95075549e0e5c36db922caf86847db7a35403 to before 8c8bcd45e9b10eef12321f08d2e5be33d615509cAffected f3a95075549e0e5c36db922caf86847db7a35403 to before 50ae82f080cf87e84828f066c31723b781d68f5bAffected f3a95075549e0e5c36db922caf86847db7a35403 to before 715d82ba636cb3629a6e18a33bb9dbe53f9936eeAffected
LinuxLinux	5.13Affected before 5.13Not affected 5.15.148 through 5.15.Not affected 6.1.75 through 6.1.Not affected 6.6.14 through 6.6.Not affected 6.7.2 through 6.7.Not affected 6.8 and laterNot affected

Product

Versions

LinuxLinux

f3a95075549e0e5c36db922caf86847db7a35403 to before a7b98aa10f895e2569403896f2d19b73b6c95653Affected
f3a95075549e0e5c36db922caf86847db7a35403 to before 6cc9c0af0aa06f781fa515a1734b1a4239dfd2c0Affected
f3a95075549e0e5c36db922caf86847db7a35403 to before 8c8bcd45e9b10eef12321f08d2e5be33d615509cAffected
f3a95075549e0e5c36db922caf86847db7a35403 to before 50ae82f080cf87e84828f066c31723b781d68f5bAffected
f3a95075549e0e5c36db922caf86847db7a35403 to before 715d82ba636cb3629a6e18a33bb9dbe53f9936eeAffected

LinuxLinux

5.13Affected
before 5.13Not affected
5.15.148 through 5.15.*Not affected
6.1.75 through 6.1.*Not affected
6.6.14 through 6.6.*Not affected
6.7.2 through 6.7.*Not affected
6.8 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.