CVE-2024-47794

What it actually does

The flaw permits an infinite loop in the BPF tail call mechanism when freplace programs are combined with tail-called programs; each execution of the freplace target resets tail_call_cnt to zero, preventing termination and causing kernel panic.

Why it matters to the business

Systems using advanced BPF networking or tracing programs on affected kernels may experience unexpected crashes and service outages; the issue affects long-lived Ubuntu LTS deployments with older kernel packages and carries no immediate ransomware or KEV exploitation signals.

How an attack unfolds

An attacker with the ability to load BPF programs crafts a set of tail-called and freplace programs whose attach targets create a cycle (entry_tc o subprog_tc o entry_freplace o tailcall back to entry_tc); the reset of the tail-call counter on each freplace invocation sustains the loop until the kernel panics.

How to fix it

Upgrade affected packages to the listed fixed versions (for example linux 4.4.0-62.83 on Ubuntu 16.04, linux-aws 4.4.0-1003.12, linux-hwe 4.8.0-39.42~16.04.1, etc.) or apply the upstream kernel patches that block updating extended programs to prog_array maps and block freplace attachment to programs already present in such maps; additionally reject BPF_PROG_TYPE_EXT programs when adding them to prog_array maps.

How to confirm the fix worked

Confirm the running kernel package version matches or exceeds the fixed version for the distribution; attempt to load test programs that combine tail calls with freplace and verify that the kernel now returns -EINVAL or prevents the attachment instead of allowing the loop.

Typical attack path

1. Obtain privileges required to load and attach BPF programs
2. Load a prog_array map containing a tail-called program
3. Attach an freplace program to a subprogram reachable via that tail call
4. Trigger the initial tail call to start the cycle
5. Observe repeated execution that never decrements the tail-call limit, resulting in panic

How to detect it

Review kernel logs (dmesg, /var/log/kern.log) for oops or panic messages mentioning bpf, tail_call_cnt or prog_array around the time of any unexplained reboots; examine audit logs for bpf() syscalls that load EXT-type programs or update prog_array maps after the vulnerability window.

What your security team should do

• Prioritize patching any remaining Ubuntu 14.04/16.04 systems still running the listed vulnerable kernels
• Audit environments for custom BPF programs that use both tail calls and freplace extensions
• Block untrusted BPF loading via LSM or seccomp policies until patches are applied
• Monitor kernel crash logs for BPF-related oops or panic signatures after the published date