{"id":"CVE-2024-46783","revision":"92106039828e4fb084767733d6c97c05","records":[{"revision":"92106039828e4fb084767733d6c97c05","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2024-46783","aliases":[],"title":"tcp_bpf: fix return value of tcp_bpf_sendmsg()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ntcp_bpf: fix return value of tcp_bpf_sendmsg()\n\nWhen we cork messages in psock->cork, the last message triggers the\nflushing will result in sending a sk_msg larger than the current\nmessage size. In this case, in tcp_bpf_send_verdict(), 'copied' becomes\nnegative at least in the following case:\n\n468 case __SK_DROP:\n469 default:\n470 sk_msg_free_partial(sk, msg, tosend);\n471 sk_msg_apply_bytes(psock, tosend);\n472 *copied -= (tosend + delta); // <==== HERE\n473 return -EACCES;\n\nTherefore, it could lead to the following BUG with a proper value of\n'copied' (thanks to syzbot). We should not use negative 'copied' as a\nreturn value here.\n\n ------------[ cut here ]------------\n kernel BUG at net/socket.c:733!\n Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP\n Modules linked in:\n CPU: 0 UID: 0 PID: 3265 Comm: syz-executor510 Not tainted 6.11.0-rc3-syzkaller-00060-gd07b43284ab3 #0\n Hardware name: linux,dummy-virt (DT)\n pstate: 61400009 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)\n pc : sock_sendmsg_nosec net/socket.c:733 [inline]\n pc : sock_sendmsg_nosec net/socket.c:728 [inline]\n pc : __sock_sendmsg+0x5c/0x60 net/socket.c:745\n lr : sock_sendmsg_nosec net/socket.c:730 [inline]\n lr : __sock_sendmsg+0x54/0x60 net/socket.c:745\n sp : ffff800088ea3b30\n x29: ffff800088ea3b30 x28: fbf00000062bc900 x27: 0000000000000000\n x26: ffff800088ea3bc0 x25: ffff800088ea3bc0 x24: 0000000000000000\n x23: f9f00000048dc000 x22: 0000000000000000 x21: ffff800088ea3d90\n x20: f9f00000048dc000 x19: ffff800088ea3d90 x18: 0000000000000001\n x17: 0000000000000000 x16: 0000000000000000 x15: 000000002002ffaf\n x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000\n x11: 0000000000000000 x10: ffff8000815849c0 x9 : ffff8000815b49c0\n x8 : 0000000000000000 x7 : 000000000000003f x6 : 0000000000000000\n x5 : 00000000000007e0 x4 : fff07ffffd239000 x3 : fbf00000062bc900\n x2 : 0000000000000000 x1 : 0000000000000000 x0 : 00000000fffffdef\n Call trace:\n sock_sendmsg_nosec net/socket.c:733 [inline]\n __sock_sendmsg+0x5c/0x60 net/socket.c:745\n ____sys_sendmsg+0x274/0x2ac net/socket.c:2597\n ___sys_sendmsg+0xac/0x100 net/socket.c:2651\n __sys_sendmsg+0x84/0xe0 net/socket.c:2680\n __do_sys_sendmsg net/socket.c:2689 [inline]\n __se_sys_sendmsg net/socket.c:2687 [inline]\n __arm64_sys_sendmsg+0x24/0x30 net/socket.c:2687\n __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]\n invoke_syscall+0x48/0x110 arch/arm64/kernel/syscall.c:49\n el0_svc_common.constprop.0+0x40/0xe0 arch/arm64/kernel/syscall.c:132\n do_el0_svc+0x1c/0x28 arch/arm64/kernel/syscall.c:151\n el0_svc+0x34/0xec arch/arm64/kernel/entry-common.c:712\n el0t_64_sync_handler+0x100/0x12c arch/arm64/kernel/entry-common.c:730\n el0t_64_sync+0x19c/0x1a0 arch/arm64/kernel/entry.S:598\n Code: f9404463 d63f0060 3108441f 54fffe81 (d4210000)\n ---[ end trace 0000000000000000 ]---","state":0,"publishedAt":"2024-09-18T07:12:39.573+00:00","modifiedAt":"2026-10-15T00:50:54.512+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"product\": \"Linux\",\n \"vendor\": \"Linux\",\n \"defaultStatus\": \"unaffected\",\n \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n \"programFiles\": [\n \"net/ipv4/tcp_bpf.c\"\n ],\n \"versions\": [\n {\n \"version\": \"4f738adba30a7cfc006f605707e7aee847ffefa0\",\n \"lessThan\": \"6f9fdf5806cced888c43512bccbdf7fefd50f510\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"4f738adba30a7cfc006f605707e7aee847ffefa0\",\n \"lessThan\": \"3efe53eb221a38e207c1e3f81c51e4ca057d50c2\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"4f738adba30a7cfc006f605707e7aee847ffefa0\",\n \"lessThan\": \"78bb38d9c5a311c5f8bdef7c9557d7d81ca30e4a\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"4f738adba30a7cfc006f605707e7aee847ffefa0\",\n \"lessThan\": \"810a4e7d92dea4074cb04c25758320909d752193\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"4f738adba30a7cfc006f605707e7aee847ffefa0\",\n \"lessThan\": \"c8219a27fa43a2cbf99f5176f6dddfe73e7a24ae\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"4f738adba30a7cfc006f605707e7aee847ffefa0\",\n \"lessThan\": \"126d72b726c4cf1119f3a7fe413a78d341c3fea9\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"4f738adba30a7cfc006f605707e7aee847ffefa0\",\n \"lessThan\": \"fe1910f9337bd46a9343967b547ccab26b4b2c6e\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n }\n ]\n }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"product\": \"Linux\",\n \"vendor\": \"Linux\",\n \"defaultStatus\": \"affected\",\n \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n \"programFiles\": [\n \"net/ipv4/tcp_bpf.c\"\n ],\n \"versions\": [\n {\n \"version\": \"4.17\",\n \"status\": \"affected\"\n },\n {\n \"version\": \"0\",\n \"lessThan\": \"4.17\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"5.4.284\",\n \"lessThanOrEqual\": \"5.4.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"5.10.226\",\n \"lessThanOrEqual\": \"5.10.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"5.15.167\",\n \"lessThanOrEqual\": \"5.15.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.1.110\",\n \"lessThanOrEqual\": \"6.1.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.6.51\",\n \"lessThanOrEqual\": \"6.6.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.10.10\",\n \"lessThanOrEqual\": \"6.10.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.11\",\n \"lessThanOrEqual\": \"*\",\n \"status\": \"unaffected\",\n \"versionType\": \"original_commit_for_fix\"\n }\n ]\n }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/6f9fdf5806cced888c43512bccbdf7fefd50f510","https://git.kernel.org/stable/c/3efe53eb221a38e207c1e3f81c51e4ca057d50c2","https://git.kernel.org/stable/c/78bb38d9c5a311c5f8bdef7c9557d7d81ca30e4a","https://git.kernel.org/stable/c/810a4e7d92dea4074cb04c25758320909d752193","https://git.kernel.org/stable/c/c8219a27fa43a2cbf99f5176f6dddfe73e7a24ae","https://git.kernel.org/stable/c/126d72b726c4cf1119f3a7fe413a78d341c3fea9","https://git.kernel.org/stable/c/fe1910f9337bd46a9343967b547ccab26b4b2c6e"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2024-46783","license":"CVE Program Terms of Use","key":"cve-program:CVE-2024-46783","identifiers":["CVE-2024-46783"]},"retained":false,"historicalAffected":[]}],"coverage":[]}