{"id":"CVE-2024-50262","revision":"87ed8283c2f64fccbdeaa32766df7295","records":[{"revision":"87ed8283c2f64fccbdeaa32766df7295","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2024-50262","aliases":[],"title":"bpf: Fix out-of-bounds write in trie_get_next_key()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix out-of-bounds write in trie_get_next_key()\n\ntrie_get_next_key() allocates a node stack with size trie->max_prefixlen,\nwhile it writes (trie->max_prefixlen + 1) nodes to the stack when it has\nfull paths from the root to leaves. For example, consider a trie with\nmax_prefixlen is 8, and the nodes with key 0x00/0, 0x00/1, 0x00/2, ...\n0x00/8 inserted. Subsequent calls to trie_get_next_key with _key with\n.prefixlen = 8 make 9 nodes be written on the node stack with size 8.","state":0,"publishedAt":"2024-11-09T10:17:50.461+00:00","modifiedAt":"2026-10-15T00:57:42.947+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"kernel/bpf/lpm_trie.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"b471f2f1de8b816f1e799b80aa92588f3566e4bd\",\n                            \"lessThan\": \"e8494ac079814a53fbc2258d2743e720907488ed\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"b471f2f1de8b816f1e799b80aa92588f3566e4bd\",\n                            \"lessThan\": \"91afbc0eb3c90258ae378ae3c6ead3d2371e926d\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"b471f2f1de8b816f1e799b80aa92588f3566e4bd\",\n                            \"lessThan\": \"590976f921723d53ac199c01d5b7b73a94875e68\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"b471f2f1de8b816f1e799b80aa92588f3566e4bd\",\n                            \"lessThan\": \"86c8ebe02d8806dd8878d0063e8e185622ab6ea6\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"b471f2f1de8b816f1e799b80aa92588f3566e4bd\",\n                            \"lessThan\": \"a035df0b98df424559fd383e8e1a268f422ea2ba\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"b471f2f1de8b816f1e799b80aa92588f3566e4bd\",\n                            \"lessThan\": \"90a6e0e1e151ef7a9282e78f54c3091de2dcc99c\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"b471f2f1de8b816f1e799b80aa92588f3566e4bd\",\n                            \"lessThan\": \"c4b4f9a9ab82238cb158fa4fe61a8c0ae21a4980\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"b471f2f1de8b816f1e799b80aa92588f3566e4bd\",\n                            \"lessThan\": \"13400ac8fb80c57c2bfb12ebd35ee121ce9b4d21\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"kernel/bpf/lpm_trie.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"4.16\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"4.16\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"4.19.323\",\n                            \"lessThanOrEqual\": \"4.19.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.4.285\",\n                            \"lessThanOrEqual\": \"5.4.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.229\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.171\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.116\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.60\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.11.7\",\n                            \"lessThanOrEqual\": \"6.11.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/e8494ac079814a53fbc2258d2743e720907488ed","https://git.kernel.org/stable/c/91afbc0eb3c90258ae378ae3c6ead3d2371e926d","https://git.kernel.org/stable/c/590976f921723d53ac199c01d5b7b73a94875e68","https://git.kernel.org/stable/c/86c8ebe02d8806dd8878d0063e8e185622ab6ea6","https://git.kernel.org/stable/c/a035df0b98df424559fd383e8e1a268f422ea2ba","https://git.kernel.org/stable/c/90a6e0e1e151ef7a9282e78f54c3091de2dcc99c","https://git.kernel.org/stable/c/c4b4f9a9ab82238cb158fa4fe61a8c0ae21a4980","https://git.kernel.org/stable/c/13400ac8fb80c57c2bfb12ebd35ee121ce9b4d21"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2024-50262","license":"CVE Program Terms of Use","key":"cve-program:CVE-2024-50262","identifiers":["CVE-2024-50262"]},"retained":false,"historicalAffected":[]}],"coverage":[]}