{"id":"CVE-2024-46754","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Remove tst_run from lwt_seg6local_prog_ops.\n\nThe syzbot reported that the lwt_seg6 related BPF ops can be invoked\nvia bpf_test_run() without without entering input…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Remove tst_run from lwt_seg6local_prog_ops.\n\nThe syzbot reported that the lwt_seg6 related BPF ops can be invoked\nvia bpf_test_run() without without entering input…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","vendor":"linux","product":"linux_kernel","affected":["linux_kernel >= 4.18, < 6.10.10"],"patched":["linux_kernel 6.10.10"],"published":"2024-09-18","updated":"2026-09-02","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-46754","references":[{"url":"https://git.kernel.org/stable/c/9cd15511de7c619bbd0f54bb3f28e6e720ded5d6","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a675524cfbe88fd49c05ff8807a08646983e687c","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b05c2e25a5c168dbb46b6f7fcb741fd4e4f3b54a","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c13fda93aca118b8e5cd202e339046728ee7dddb","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e217492f6fa2228ad703ee3006d8fc4e5969fbd4","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ea3fae6984ba0f054550e4da22219489c12cd8d4","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-46754.json"},{"url":"https://access.redhat.com/security/cve/CVE-2024-46754"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2313102"},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-46754"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-46754"},{"url":"https://lore.kernel.org/linux-cve-announce/2024091840-CVE-2024-46754-7f04@gregkh/T"},{"url":"https://access.redhat.com/errata/RHSA-2025:6966"}],"tags":["nvd","csaf","vex","red-hat","score-dispute"],"epss":0.00247,"epssPercentile":0.16298,"ingestedAt":"2026-09-02T13:44:40.752Z","cwe":["CWE-666"],"scores":{"nvd":7.8,"vendor":5.5},"slug":"CVE-2024-46754","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Remove tst_run from lwt_seg6local_prog_ops.\n\nThe syzbot reported that the lwt_seg6 related BPF ops can be invoked\nvia bpf_test_run() without without entering input_action_end_bpf()\nfirst.\n\nMartin KaFai Lau said that self test for BPF_PROG_TYPE_LWT_SEG6LOCAL\nprobably didn't work since it was introduced in commit 04d4b274e2a\n(\"ipv6: sr: Add seg6local action End.BPF\"). The reason is that the\nper-CPU variable seg6_bpf_srh_states::srh is never assigned in the self\ntest case but each BPF function expects it.\n\nRemove test_run for BPF_PROG_TYPE_LWT_SEG6LOCAL.\n\n## Affected\n\n- `linux_kernel >= 4.18, < 6.10.10`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `linux_kernel 6.10.10`\n\n## Vendor advisories\n\n- **RHSA-2025:6966** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9), Red Hat Enterprise Linux Real Time (v. 9) · released 2025-05-13 · [advisory](https://access.redhat.com/errata/RHSA-2025:6966)\n- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 · updated 2026-09-13 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-46754.json)","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}