{"id":"CVE-2024-53125","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: sync_linked_regs() must preserve subreg_def\n\nRange propagation must not affect subreg_def marks, otherwise the\nfollowing example is rewritten by verifier incorrect…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: sync_linked_regs() must preserve subreg_def\n\nRange propagation must not affect subreg_def marks, otherwise the\nfollowing example is rewritten by verifier incorrect…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-682"],"vendor":"linux","product":"linux_kernel","affected":["linux_kernel >= 5.10, < 5.10.232","linux_kernel >= 5.11, < 5.15.175","linux_kernel >= 5.16, < 6.1.121","linux_kernel >= 6.2, < 6.6.67","linux_kernel >= 6.7, < 6.11.6","linux_kernel = 6.12"],"patched":["linux_kernel 6.11.6"],"published":"2024-12-04","updated":"2026-10-15","sourceUpdated":"2026-10-15T22:17:59.843","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-53125","references":[{"url":"https://git.kernel.org/stable/c/60fd3538d2a8fd44c41d25088c0ece3e1fd30659","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b57ac2d92c1f565743f6890a5b9cf317ed856b09","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bfe9446ea1d95f6cb7848da19dfd58d2eec6fd84","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/dadf82c1b2608727bcc306843b540cd7414055a7","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e2ef0f317a52e678fe8fa84b94d6a15b466d6ff0","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e9bd9c498cb0f5843996dbe5cbce7a1836a83c70","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-53125.json"},{"url":"https://access.redhat.com/security/cve/CVE-2024-53125"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2330351"},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-53125"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53125"},{"url":"https://lore.kernel.org/linux-cve-announce/2024120413-CVE-2024-53125-69ff@gregkh/T"}],"tags":["nvd","csaf","vex","red-hat","cve.org","score-dispute"],"epss":0.0023,"epssPercentile":0.13739,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-15T21:40:40.266518Z"},"scores":{"nvd":7.8,"vendor":4.4,"cna":7.8},"ingestedAt":"2026-10-15T22:48:25.441Z","slug":"CVE-2024-53125","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbpf: sync_linked_regs() must preserve subreg_def\n\nRange propagation must not affect subreg_def marks, otherwise the\nfollowing example is rewritten by verifier incorrectly when\nBPF_F_TEST_RND_HI32 flag is set:\n\n  0: call bpf_ktime_get_ns                   call bpf_ktime_get_ns\n  1: r0 &= 0x7fffffff       after verifier   r0 &= 0x7fffffff\n  2: w1 = w0                rewrites         w1 = w0\n  3: if w0 < 10 goto +0     -------------->  r11 = 0x2f5674a6     (r)\n  4: r1 >>= 32                               r11 <<= 32           (r)\n  5: r0 = r1                                 r1 |= r11            (r)\n  6: exit;                                   if w0 < 0xa goto pc+0\n                                             r1 >>= 32\n                                             r0 = r1\n                                             exit\n\n(or zero extension of w1 at (2) is missing for architectures that\n require zero extension for upper register half).\n\nThe following happens w/o this patch:\n- r0 is marked as not a subreg at (0);\n- w1 is marked as subreg at (2);\n- w1 subreg_def is overridden at (3) by copy_register_state();\n- w1 is read at (5) but mark_insn_zext() does not mark (2)\n  for zero extension, because w1 subreg_def is not set;\n- because of BPF_F_TEST_RND_HI32 flag verifier inserts random\n  value for hi32 bits of (2) (marked (r));\n- this random value is read at (5).\n\n## Affected\n\n- `linux_kernel >= 5.10, < 5.10.232`\n- `linux_kernel >= 5.11, < 5.15.175`\n- `linux_kernel >= 5.16, < 6.1.121`\n- `linux_kernel >= 6.2, < 6.6.67`\n- `linux_kernel >= 6.7, < 6.11.6`\n- `linux_kernel = 6.12`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `linux_kernel 6.11.6`\n\n## Vendor advisories\n\n- **Red Hat VEX** · Low · affected: Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 · updated 2026-10-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-53125.json)","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":229991,"id":"CVE-2024-53125","ts":1793124765349,"field":"cvss","old":"4.4","new":"7.8"},{"seq":229990,"id":"CVE-2024-53125","ts":1793124765349,"field":"severity","old":"medium","new":"high"},{"seq":223693,"id":"CVE-2024-53125","ts":1792238368880,"field":"cvss","old":"7.8","new":"4.4"},{"seq":223692,"id":"CVE-2024-53125","ts":1792238368880,"field":"severity","old":"high","new":"medium"}]}