CVE-2024-43840bpf, arm64: Fix trampoline for BPF_TRAMP_F_CALL_ORIG
- 7.8HighCVSS base score
- 0.23%Exploitation in 30 daysEPSS · top 86% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: bpf, arm64: Fix trampoline for BPF_TRAMP_F_CALL_ORIG When BPF_TRAMP_F_CALL_ORIG is set, the trampoline calls __bpf_tramp_enter() and __bpf_tramp_exit() functions, passing them the struct bpf_tramp_image *im pointer as an argument in R0. The trampoline generation code uses emit_addr_mov_i64() to emit instructions for moving the bpf_tramp_image address into R0, but emit_addr_mov_i64() assumes the address to be in the vmalloc() space and uses only 48 bits. Because bpf_tramp_image is allocated using kzalloc(), its address can use more than 48-bits, in this case the trampoline will pass an invalid address to __bpf_tramp_enter/exit() causing a kernel crash. Fix this by using emit_a64_mov_i64() in place of emit_addr_mov_i64() as it can work with addresses that are greater than 48-bits.
Timeline
ID reserved
By Linux
Published
- 24 months later
· 24 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| LinuxCNA (assigner) | 3.1 | High7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVDNVD · Modified | 3.1 | Medium5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
- EPSS (exploitation in 30 days)
- 0.23% · top 86% of all CVEs (14 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.8.
Affected products
- affected efc9909fdce00a827a37609628223cd45bf95d0b – < 077149478497b2f00ff4fd9da2c892defa6418d8
- affected efc9909fdce00a827a37609628223cd45bf95d0b – < d9664e6ff040798a46cdc5d401064f55b8676c83
- affected efc9909fdce00a827a37609628223cd45bf95d0b – < 6d218fcc707d6b2c3616b6cd24b948fd4825cfec
- affected efc9909fdce00a827a37609628223cd45bf95d0b – < 19d3c179a37730caf600a97fed3794feac2b197b
- affected 6.0
- unaffected < 6.0
- unaffected 6.1.140 – ≤ 6.1.*
- unaffected 6.6.92 – ≤ 6.6.*
- unaffected 6.10.3 – ≤ 6.10.*
- unaffected 6.11 – ≤ *
References
References5
- https://git.kernel.org/stable/c/077149478497b2f00ff4fd9da2c892defa6418d8 (opens in a new tab)
- https://git.kernel.org/stable/c/d9664e6ff040798a46cdc5d401064f55b8676c83 (opens in a new tab)
- https://git.kernel.org/stable/c/6d218fcc707d6b2c3616b6cd24b948fd4825cfec (opens in a new tab)
- https://git.kernel.org/stable/c/19d3c179a37730caf600a97fed3794feac2b197b (opens in a new tab)
- https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2024-40490 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2024-43840)Record last updated .