---
id: CVE-2024-58237
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  bpf: consider that tail calls invalidate packet pointers

  Tail-called programs could execute any of the helpers that invalidate
  packet pointers
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  bpf: consider that tail calls invalidate packet pointers

  Tail-called programs could execute any of the helpers that invalidate
  packet pointers. Hence, conservatively a…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-476
vendor: linux
product: linux_kernel
affected:
  - 'linux_kernel >= 5.6, < 6.6.90'
  - 'linux_kernel >= 6.7, < 6.12.9'
  - linux_kernel = 6.13
patched:
  - linux_kernel 6.12.9
published: '2025-05-05'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T22:18:06.170'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2024-58237'
references:
  - url: 'https://git.kernel.org/stable/c/1a4607ffba35bf2a630aab299e34dd3f6e658d70'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/1c2244437f9ad3dd91215f920401a14f2542dbfc'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/f1692ee23dcaaddc24ba407b269707ee5df1301f'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
epss: 0.00196
epssPercentile: 0.09256
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-15T21:42:22.906486Z'
ingestedAt: '2026-10-15T22:48:25.466Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

bpf: consider that tail calls invalidate packet pointers

Tail-called programs could execute any of the helpers that invalidate
packet pointers. Hence, conservatively assume that each tail call
invalidates packet pointers.

Making the change in bpf_helper_changes_pkt_data() automatically makes
use of check_cfg() logic that computes 'changes_pkt_data' effect for
global sub-programs, such that the following program could be
rejected:

    int tail_call(struct __sk_buff *sk)
    {
    	bpf_tail_call_static(sk, &jmp_table, 0);
    	return 0;
    }

    SEC("tc")
    int not_safe(struct __sk_buff *sk)
    {
    	int *p = (void *)(long)sk->data;
    	... make p valid ...
    	tail_call(sk);
    	*p = 42; /* this is unsafe */
    	...
    }

The tc_bpf2bpf.c:subprog_tc() needs change: mark it as a function that
can invalidate packet pointers. Otherwise, it can't be freplaced with
tailcall_freplace.c:entry_freplace() that does a tail call.

## Affected

- `linux_kernel >= 5.6, < 6.6.90`
- `linux_kernel >= 6.7, < 6.12.9`
- `linux_kernel = 6.13`

## Remediation

Upgrade past the affected range:

- `linux_kernel 6.12.9`