CVE-2024-35903

What it actually does

Incorrect instruction pointer calculation after x86_call_depth_emit_accounting emits code causes emit_patch to skip instructions, resulting in invalid execution paths and likely kernel crash in BPF programs on x86.

Why it matters to the business

Linux systems running BPF workloads may experience unexpected crashes or instability, disrupting services and requiring restarts or rollbacks until kernels are updated.

How an attack unfolds

An attacker crafts or triggers a BPF program that exercises call depth accounting on x86; the miscalculated IP skips instructions, leading to a crash. No named threat actors are known to exploit this specific issue.

How to fix it

Update the Linux kernel to the commit 3f9d57c771656bfd651e22edcfdb5f60e62542d4 or later stable releases that contain the fix.

How to confirm the fix worked

Confirm the running kernel contains commit 3f9d57c771656bfd651e22edcfdb5f60e62542d4; test BPF programs that previously triggered accounting emission to verify no crashes occur.

Typical attack path

1. Identify or load a BPF program that triggers x86_call_depth_emit_accounting
2. Execute the program to cause emit_patch to receive an incorrect IP offset
3. Kernel skips instructions and crashes

How to detect it

Review kernel logs for oops or panic messages mentioning bpf or x86_call_depth_emit_accounting; no public exploitation artifacts are known.

What your security team should do

• Prioritize kernel upgrades on all x86 systems that use BPF
• Monitor for kernel oops or crashes related to BPF call emission
• Apply the fix in the next maintenance window given the stable EPSS and lack of KEV listing