---
id: CVE-2024-46754
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  bpf: Remove tst_run from lwt_seg6local_prog_ops.

  The syzbot reported that the lwt_seg6 related BPF ops can be invoked
  via bpf_test_run() without without entering input…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  bpf: Remove tst_run from lwt_seg6local_prog_ops.

  The syzbot reported that the lwt_seg6 related BPF ops can be invoked
  via bpf_test_run() without without entering input…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
vendor: linux
product: linux_kernel
affected:
  - 'linux_kernel >= 4.18, < 6.10.10'
patched:
  - linux_kernel 6.10.10
published: '2024-09-18'
updated: '2026-09-02'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2024-46754'
references:
  - url: 'https://git.kernel.org/stable/c/9cd15511de7c619bbd0f54bb3f28e6e720ded5d6'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/a675524cfbe88fd49c05ff8807a08646983e687c'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/b05c2e25a5c168dbb46b6f7fcb741fd4e4f3b54a'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/c13fda93aca118b8e5cd202e339046728ee7dddb'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/e217492f6fa2228ad703ee3006d8fc4e5969fbd4'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/ea3fae6984ba0f054550e4da22219489c12cd8d4'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-46754.json
  - url: 'https://access.redhat.com/security/cve/CVE-2024-46754'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2313102'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2024-46754'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2024-46754'
  - url: >-
      https://lore.kernel.org/linux-cve-announce/2024091840-CVE-2024-46754-7f04@gregkh/T
  - url: 'https://access.redhat.com/errata/RHSA-2025:6966'
tags:
  - nvd
  - csaf
  - vex
  - red-hat
  - score-dispute
epss: 0.00247
epssPercentile: 0.14201
ingestedAt: '2026-09-02T13:44:40.752Z'
cwe:
  - CWE-666
scores:
  nvd: 7.8
  vendor: 5.5
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

bpf: Remove tst_run from lwt_seg6local_prog_ops.

The syzbot reported that the lwt_seg6 related BPF ops can be invoked
via bpf_test_run() without without entering input_action_end_bpf()
first.

Martin KaFai Lau said that self test for BPF_PROG_TYPE_LWT_SEG6LOCAL
probably didn't work since it was introduced in commit 04d4b274e2a
("ipv6: sr: Add seg6local action End.BPF"). The reason is that the
per-CPU variable seg6_bpf_srh_states::srh is never assigned in the self
test case but each BPF function expects it.

Remove test_run for BPF_PROG_TYPE_LWT_SEG6LOCAL.

## Affected

- `linux_kernel >= 4.18, < 6.10.10`

## Remediation

Upgrade past the affected range:

- `linux_kernel 6.10.10`

## Vendor advisories

- **RHSA-2025:6966** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9), Red Hat Enterprise Linux Real Time (v. 9) · released 2025-05-13 · [advisory](https://access.redhat.com/errata/RHSA-2025:6966)
- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 · updated 2026-09-13 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-46754.json)