01 Record

CVE-2024-26884

bpf: Fix hashtab overflow check on 32-bit arches

HighPUBLISHEDCNA: Linux

CNA base score7.8 CVSS v3.xCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

View raw JSON

02 Description

bpf: Fix hashtab overflow check on 32-bit arches

03 Exploitation and scoring

Exploitation

Assessed, none found. CISA's assessment recorded neither public exploit code nor evidence of exploitation when it was made.

SSVC decision

ExploitationnoneCISA recorded no public exploit code and no evidence of exploitation.
AutomatablenoAt least one step from reconnaissance to exploitation cannot be reliably automated.
Technical ImpacttotalSuccessful exploitation gives total control of the vulnerable component.

CISA publishes the decision points, not a final SSVC decision. The decision also depends on mission and well-being impact, which is a property of your deployment rather than of the vulnerability.

EPSS probability

0.25% probability of exploitation activity in the next 30 days.

EPSS percentile

Equal to or higher than the score of 16.2% of scored records. A rank, not a probability.

NVD base score

7.8 (CVSS v3.x), scored by the NVD independently of the CNA.

NVD CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD analysis status

Modified. NVD last modified this record on 2026-10-15.

Red Hat severity

Low. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2024-04-17 10:27Z2 YR AGO

Last updated

2026-10-15 00:39Z14 DAYS AGO

Reserved

2024-02-19

Assigning CNA

Linux

Record state

PUBLISHED

Severity

High (CVSS 7.8)

CNA CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-190Integer Overflow or WraparoundBase
CWE-119Improper Restriction of Operations within the Bounds of a Memory BufferClass

Data version

5.2

Document digest

54fe9e6f4681a8aebf57382ecdc1d6a9d13dc1a98dc83955babc323a222fcd01

05 Affected products

VendorProductVersionsPlatforms

LinuxLinuxdaaf427c6ab392bedcd018e326b2ffa1e1110cd6 to < 33ec04cadb77605b71d9298311919303d390c4d5, daaf427c6ab392bedcd018e326b2ffa1e1110cd6 to < 92c81fbb3ed2e0dfc33a4183a67135e1ab566ace, daaf427c6ab392bedcd018e326b2ffa1e1110cd6 to < 64f00b4df0597590b199b62a37a165473bf658a6, daaf427c6ab392bedcd018e326b2ffa1e1110cd6 to < 3b08cfc65f07b1132c1979d73f014ae6e04de55d, daaf427c6ab392bedcd018e326b2ffa1e1110cd6 to < a83fdaeaea3677b83a53f72ace2d73a19bcd6d93, daaf427c6ab392bedcd018e326b2ffa1e1110cd6 to < 8435f0961bf3dc65e204094349bd9aeaac1f8868, daaf427c6ab392bedcd018e326b2ffa1e1110cd6 to < d817f0d34d927f2deb17dadbfe212c9a6a32ac3e, daaf427c6ab392bedcd018e326b2ffa1e1110cd6 to < a6fa75b5096c0f9826a4fabe22d907b0a5bb1016, daaf427c6ab392bedcd018e326b2ffa1e1110cd6 to < 6787d916c2cf9850c97a0a3f73e08c43e7d973b1, 3.19—

06 References

git.kernel.orghttps://git.kernel.org/stable/c/33ec04cadb77605b71d9298311919303d390c4d5
git.kernel.orghttps://git.kernel.org/stable/c/92c81fbb3ed2e0dfc33a4183a67135e1ab566ace
git.kernel.orghttps://git.kernel.org/stable/c/64f00b4df0597590b199b62a37a165473bf658a6
git.kernel.orghttps://git.kernel.org/stable/c/3b08cfc65f07b1132c1979d73f014ae6e04de55d
git.kernel.orghttps://git.kernel.org/stable/c/a83fdaeaea3677b83a53f72ace2d73a19bcd6d93
git.kernel.orghttps://git.kernel.org/stable/c/8435f0961bf3dc65e204094349bd9aeaac1f8868
git.kernel.orghttps://git.kernel.org/stable/c/d817f0d34d927f2deb17dadbfe212c9a6a32ac3e
git.kernel.orghttps://git.kernel.org/stable/c/a6fa75b5096c0f9826a4fabe22d907b0a5bb1016
git.kernel.orghttps://git.kernel.org/stable/c/6787d916c2cf9850c97a0a3f73e08c43e7d973b1
lists.debian.orghttps://lists.debian.org/debian-lts-announce/2024/06/msg00017.html
lists.debian.orghttps://lists.debian.org/debian-lts-announce/2024/06/msg00020.html
cert-portal.siemens.comhttps://cert-portal.siemens.com/productcert/html/ssa-265688.html

07 Fixed in

Debian 12

linux
Fixed in 6.1.85-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 13

linux
Fixed in 6.7.12-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 14

linux
Fixed in 6.7.12-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.