---
id: CVE-2024-58100
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  bpf: check changes_pkt_data property for extension programs

  When processing calls to global sub-programs, verifier decides whether
  to invalidate all packet pointers in…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  bpf: check changes_pkt_data property for extension programs

  When processing calls to global sub-programs, verifier decides whether
  to invalidate all packet pointers in…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
vendor: linux
product: linux_kernel
affected:
  - 'linux_kernel >= 5.6, < 6.6.90'
  - 'linux_kernel >= 6.7, < 6.12.25'
  - linux_kernel = 6.13
patched:
  - linux_kernel 6.12.25
published: '2025-05-05'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T22:18:06.013'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2024-58100'
references:
  - url: 'https://git.kernel.org/stable/c/3846e2bea565ee1c5195dcc625fda9868fb0e3b3'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/7197fc4acdf238ec8ad06de5a8235df0c1f9c7d7'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/81f6d0530ba031b5f038a091619bf2ff29568852'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
epss: 0.00196
epssPercentile: 0.09256
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-15T21:42:20.766828Z'
ingestedAt: '2026-10-15T22:48:25.464Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

bpf: check changes_pkt_data property for extension programs

When processing calls to global sub-programs, verifier decides whether
to invalidate all packet pointers in current state depending on the
changes_pkt_data property of the global sub-program.

Because of this, an extension program replacing a global sub-program
must be compatible with changes_pkt_data property of the sub-program
being replaced.

This commit:
- adds changes_pkt_data flag to struct bpf_prog_aux:
  - this flag is set in check_cfg() for main sub-program;
  - in jit_subprogs() for other sub-programs;
- modifies bpf_check_attach_btf_id() to check changes_pkt_data flag;
- moves call to check_attach_btf_id() after the call to check_cfg(),
  because it needs changes_pkt_data flag to be set:

    bpf_check:
      ...                             ...
    - check_attach_btf_id             resolve_pseudo_ldimm64
      resolve_pseudo_ldimm64   -->    bpf_prog_is_offloaded
      bpf_prog_is_offloaded           check_cfg
      check_cfg                     + check_attach_btf_id
      ...                             ...

The following fields are set by check_attach_btf_id():
- env->ops
- prog->aux->attach_btf_trace
- prog->aux->attach_func_name
- prog->aux->attach_func_proto
- prog->aux->dst_trampoline
- prog->aux->mod
- prog->aux->saved_dst_attach_type
- prog->aux->saved_dst_prog_type
- prog->expected_attach_type

Neither of these fields are used by resolve_pseudo_ldimm64() or
bpf_prog_offload_verifier_prep() (for netronome and netdevsim
drivers), so the reordering is safe.

## Affected

- `linux_kernel >= 5.6, < 6.6.90`
- `linux_kernel >= 6.7, < 6.12.25`
- `linux_kernel = 6.13`

## Remediation

Upgrade past the affected range:

- `linux_kernel 6.12.25`