High 7.8Published Dec 4, 2024

CVE-2024-53125bpf: sync_linked_regs() must preserve subreg_def

Updated under an hour ago (Oct 27, 2026, 4:23 PM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: bpf: sync_linked_regs() must preserve subreg_def Range propagation must not affect subreg_def marks, otherwise the following example is rewritten by verifier incorrectly when BPF_F_TEST_RND_HI32 flag is set: 0: call bpf_ktime_get_ns call bpf_ktime_get_ns 1: r0 &= 0x7fffffff after verifier r0 &= 0x7fffffff 2: w1 = w0 rewrites w1 = w0 3: if w0 < 10 goto +0 --------------> r11 = 0x2f5674a6 (r) 4: r1 >>= 32 r11 <<= 32 (r) 5: r0 = r1 r1 |= r11 (r) 6: exit; if w0 < 0xa goto pc+0 r1 >>= 32 r0 = r1 exit (or zero extension of w1 at (2) is missing for architectures that require zero extension for upper register half). The following happens w/o this patch: - r0 is marked as not a subreg at (0); - w1 is marked as subreg at (2); - w1 subreg_def is overridden at (3) by copy_register_state(); - w1 is read at (5) but mark_insn_zext() does not mark (2) for zero extension, because w1 subreg_def is not set; - because of BPF_F_TEST_RND_HI32 flag verifier inserts random value for hi32 bits of (2) (marked (r)); - this random value is read at (5).

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 15, 2026
First seen by InfoSec Signals: Oct 15, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 75748837b7e56919679e02163f45d5818c644d03 before dadf82c1b2608727bcc306843b540cd7414055a7; from 75748837b7e56919679e02163f45d5818c644d03 before b57ac2d92c1f565743f6890a5b9cf317ed856b09; 75748837b7e56919679e02163f45d5818c644d03 builds before 60fd3538d2a8fd44c41d25088c0ece3e1fd30659; from 75748837b7e56919679e02163f45d5818c644d03 before bfe9446ea1d95f6cb7848da19dfd58d2eec6fd84; from 75748837b7e56919679e02163f45d5818c644d03 before e2ef0f317a52e678fe8fa84b94d6a15b466d6ff0; from 75748837b7e56919679e02163f45d5818c644d03 before e9bd9c498cb0f5843996dbe5cbce7a1836a83c70	CNA record
linux linux_kernel linux:linux_kernel	from 5.10 before 5.10.232; from 5.11 before 5.15.175; from 5.16 before 6.1.121; from 6.2 before 6.6.67; from 6.7 before 6.11.6; 6.12; 6.12; 6.12	NVD

References

References

https://git.kernel.org/stable/c/dadf82c1b2608727bcc306843b540cd7414055a7	patch
https://git.kernel.org/stable/c/b57ac2d92c1f565743f6890a5b9cf317ed856b09	patch
https://git.kernel.org/stable/c/60fd3538d2a8fd44c41d25088c0ece3e1fd30659	patch
https://git.kernel.org/stable/c/bfe9446ea1d95f6cb7848da19dfd58d2eec6fd84	patch
https://git.kernel.org/stable/c/e2ef0f317a52e678fe8fa84b94d6a15b466d6ff0	patch
https://git.kernel.org/stable/c/e9bd9c498cb0f5843996dbe5cbce7a1836a83c70	patch
https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html
https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.