# CVE-2024-50161: linux: In the Linux kernel, the following vulnerability has been resolved:  bpf: Check the remaining info_cnt before repeati...

CVE-2024-50161 is fixed in linux on 1 platform, first by DEBIAN-CVE-2024-50161, released November 7, 2024. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2024-50161
- Priority: Routine
- CVSS: 5.5 (medium)
- EPSS: 0.0020
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Nov 7, 2024

## Description

In the Linux kernel, the following vulnerability has been resolved:  bpf: Check the remaining info_cnt before repeating btf fields  When trying to repeat the btf fields for array of nested struct, it doesn't check the remaining info_cnt. The following splat will be reported when the value of ret * nelems is greater than BTF_FIELDS_MAX:    ------------[ cut here ]------------   UBSAN: array-index-out-of-bounds in ../kernel/bpf/btf.c:3951:49   index 11 is out of range for type 'btf_field_info [11]'   CPU: 6 UID: 0 PID: 411 Comm: test_progs ...... 6.11.0-rc4+ #1   Tainted: [O]=OOT_MODULE   Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ...   Call Trace:    <TASK>    dump_stack_lvl+0x57/0x70    dump_stack+0x10/0x20    ubsan_epilogue+0x9/0x40    __ubsan_handle_out_of_bounds+0x6f/0x80    ? kallsyms_lookup_name+0x48/0xb0    btf_parse_fields+0x992/0xce0    map_create+0x591/0x770    __sys_bpf+0x229/0x2410    __x64_sys_bpf+0x1f/0x30    x64_sys_call+0x199/0x9f0    do_syscall_64+0x3b/0xc0    entry_SYSCALL_64_after_hwframe+0x4b/0x53   RIP: 0033:0x7fea56f2cc5d   ......    </TASK>   ---[ end trace ]---  Fix it by checking the remaining info_cnt in btf_repeat_fields() before repeating the btf fields.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 13.5 (trixie) | 6.11.6-1 | [DEBIAN-CVE-2024-50161](https://patchblox.com/security/data/fix/linux/debian-cve-2024-50161.md) | Nov 7, 2024 |
| Linux | linux Debian 14 | 6.11.6-1 | [DEBIAN-CVE-2024-50161](https://patchblox.com/security/data/fix/linux/debian-cve-2024-50161.md) | Nov 7, 2024 |

---

Data as of 2026-11-09T01:18:40Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.