VYPR
← All advisories
Medium severity4.7NVD Advisory· Published Jun 21, 2024· Updated May 12, 2026

CVE-2024-38662

CVE-2024-38662

Description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Allow delete from sockmap/sockhash only if update is allowed

We have seen an influx of syzkaller reports where a BPF program attached to a tracepoint triggers a locking rule violation by performing a map_delete on a sockmap/sockhash.

We don't intend to support this artificial use scenario. Extend the existing verifier allowed-program-type check for updating sockmap/sockhash to also cover deleting from a map.

From now on only BPF programs which were previously allowed to update sockmap/sockhash can delete from these map types.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

In the Linux kernel, BPF verifier now requires the same program-type permission for deleting from sockmap/sockhash as for updating, fixing a locking rule violation.

Vulnerability

Description

CVE-2024-38662 addresses a locking rule violation in the Linux kernel's BPF subsystem. The issue allowed BPF programs attached to tracepoints to perform map_delete operations on sockmap or sockhash maps, even though such programs were not permitted to update these maps. This inconsistency could lead to kernel locking violations and potential system instability.

Exploitation

The vulnerability can be triggered by a local attacker with the ability to load and attach BPF programs to tracepoints. Specifically, by attaching a BPF program that executes a map_delete on a sockmap/sockhash, the attacker could bypass the existing verifier checks that only restricted update operations. The attack requires the ability to run BPF programs, but does not require any special privileges beyond that.

Impact

Successful exploitation could cause a kernel locking violation, potentially leading to a denial of service by crashing the system or causing unpredictable behavior. The vulnerability has a CVSS v3 base score of 4.7 (Medium) with a vector of CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, indicating high availability impact but no confidentiality or integrity impact.

Mitigation

The fix extends the existing verifier's allowed-program-type check for updating sockmap/sockhash to also cover deletion operations [1][2]. This ensures that only BPF programs previously permitted to update these maps can delete from them. The patch was applied to the Linux kernel stable branches, as referenced in commits [3][4]. Users should update their kernels to versions containing this fix.

References
  1. SSA-613116
  2. SSA-265688
  3. Making sure you're not a bot!
  4. Making sure you're not a bot!

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

120

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

8

News mentions

0

No linked articles in our index yet.