LiveActive security incident?Get immediate response
CVE Record

CVE-2024-26591: bpf: Fix re-attachment branch in bpf_tracing_prog_attach

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix re-attachment branch in bpf_tracing_prog_attach The following case can cause a crash due to missing attach_btf: 1) load rawtp program 2) load fentry program with rawtp as target_fd 3) create tracing link for fentry program with target_fd = 0 4) repeat 3 In the end we have: - prog->aux->dst_trampoline == NULL - tgt_prog == NULL (because we did not provide target_fd to link_create) - prog->aux->attach_btf == NULL (the program was loaded with attach_prog_fd=X) - the program was loaded for tgt_prog but we have no way to find out which one BUG: kernel NULL pointer dereference, address: 0000000000000058 Call Trace: <TASK> ? __die+0x20/0x70 ? page_fault_oops+0x15b/0x430 ? fixup_exception+0x22/0x330 ? exc_page_fault+0x6f/0x170 ? asm_exc_page_fault+0x22/0x30 ? bpf_tracing_prog_attach+0x279/0x560 ? btf_obj_id+0x5/0x10 bpf_tracing_prog_attach+0x439/0x560 __sys_bpf+0x1cf4/0x2de0 __x64_sys_bpf+0x1c/0x30 do_syscall_64+0x41/0xf0 entry_SYSCALL_64_after_hwframe+0x6e/0x76 Return -EINVAL in this situation.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2024-26591 is a Linux kernel bug in BPF tracing attachment handling. A malformed re-attachment state can trigger a NULL pointer dereference and crash the kernel. The public record does not provide CVSS, KEV exploitation, or a broader impact claim beyond denial of service.

Executive priority

Handle in the regular kernel patch cycle, with higher priority for shared Linux hosts where local users or workloads may access BPF features. No source in the bundle supports emergency treatment for active exploitation.

Technical view

The issue is in bpf_tracing_prog_attach. When a tracing program is re-attached without needed target metadata, attach_btf can be NULL and the kernel dereferences it. The upstream resolution returns -EINVAL for this invalid state instead of crashing.

Likely exposure

Systems running affected Linux kernel versions with BPF tracing functionality are the relevant exposure. The bundle lists Linux as affected and references fixes across stable kernel branches. Distribution-specific package impact must be confirmed with vendor advisories or kernel changelogs.

Exploitation context

The source describes a reproducible crash path through BPF program and tracing link operations. There is no KEV listing in the bundle and no cited evidence of active exploitation. Treat this as a local kernel denial-of-service risk unless vendor guidance states otherwise.

Researcher notes

Evidence supports a kernel crash caused by invalid BPF tracing attachment state. The record lacks CVSS, CWE, and detailed affected package mapping. Avoid expanding impact beyond denial of service without additional vendor or upstream analysis.

Mitigation direction

  • Apply Linux kernel updates that include the referenced stable fixes.
  • Check distribution advisories for CVE-2024-26591 package status.
  • Prioritize shared, multi-user, container host, and developer systems using BPF tooling.
  • If updates are unavailable, follow vendor guidance for temporary exposure reduction.

Validation and detection

  • Inventory running kernel versions across Linux assets.
  • Confirm kernel packages include a CVE-2024-26591 fix or referenced stable commit.
  • Review whether workloads depend on BPF tracing features.
  • Track remediation through normal kernel reboot validation.
Prepared
Confidence
medium
Sources
7

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2024-26591 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
2ADP providers
6Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc
CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxf3a95075549e0e5c36db922caf86847db7a35403, f3a95075549e0e5c36db922caf86847db7a35403, f3a95075549e0e5c36db922caf86847db7a35403, f3a95075549e0e5c36db922caf86847db7a35403, f3a95075549e0e5c36db922caf86847db7a35403unaffected
LinuxLinux5.13, 0, 5.15.148, 6.1.75, 6.6.14, 6.7.2, 6.8affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.