{"id":"CVE-2024-38564","title":"bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE\n\nbpf_prog_attach uses attach_type_to_prog_type to enforce proper\nattach type for BPF_PROG_T…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= 3505cb9fa26cfec9512744466e754a8cbc2365b0 < 6675c541f540a29487a802d3135280b69b9f568d","Linux >= 3505cb9fa26cfec9512744466e754a8cbc2365b0 < 67929e973f5a347f05fef064fea4ae79e7cdb5fd","Linux >= 3505cb9fa26cfec9512744466e754a8cbc2365b0 < b34bbc76651065a5eafad8ddff1eb8d1f8473172","Linux >= 3505cb9fa26cfec9512744466e754a8cbc2365b0 < 543576ec15b17c0c93301ac8297333c7b6e84ac7","Linux 6.6"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2024-06-20T14:57:28.333210Z"},"published":"2024-06-19","updated":"2026-10-27","sourceUpdated":"2026-10-27T15:53:48.399Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2024-38564","references":[{"url":"https://git.kernel.org/stable/c/6675c541f540a29487a802d3135280b69b9f568d"},{"url":"https://git.kernel.org/stable/c/67929e973f5a347f05fef064fea4ae79e7cdb5fd"},{"url":"https://git.kernel.org/stable/c/b34bbc76651065a5eafad8ddff1eb8d1f8473172"},{"url":"https://git.kernel.org/stable/c/543576ec15b17c0c93301ac8297333c7b6e84ac7"}],"tags":["cve.org"],"epss":0.00239,"epssPercentile":0.14849,"ingestedAt":"2026-10-27T16:11:59.482Z","slug":"CVE-2024-38564","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE\n\nbpf_prog_attach uses attach_type_to_prog_type to enforce proper\nattach type for BPF_PROG_TYPE_CGROUP_SKB. link_create uses\nbpf_prog_get and relies on bpf_prog_attach_check_attach_type\nto properly verify prog_type <> attach_type association.\n\nAdd missing attach_type enforcement for the link_create case.\nOtherwise, it's currently possible to attach cgroup_skb prog\ntypes to other cgroup hooks.\n\n## Affected\n\n- `Linux >= 3505cb9fa26cfec9512744466e754a8cbc2365b0 < 6675c541f540a29487a802d3135280b69b9f568d`\n- `Linux >= 3505cb9fa26cfec9512744466e754a8cbc2365b0 < 67929e973f5a347f05fef064fea4ae79e7cdb5fd`\n- `Linux >= 3505cb9fa26cfec9512744466e754a8cbc2365b0 < b34bbc76651065a5eafad8ddff1eb8d1f8473172`\n- `Linux >= 3505cb9fa26cfec9512744466e754a8cbc2365b0 < 543576ec15b17c0c93301ac8297333c7b6e84ac7`\n- `Linux 6.6`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}