{
  "cveId": "CVE-2024-50254",
  "url": "https://patchblox.com/security/cve/CVE-2024-50254",
  "summary": "CVE-2024-50254 is fixed in linux on 1 platform, first by DEBIAN-CVE-2024-50254, released November 9, 2024. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  bpf: Free dynamically allocated bits in bpf_iter...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  bpf: Free dynamically allocated bits in bpf_iter_bits_destroy()  bpf_iter_bits_destroy() uses \u0022kit-\u003Enr_bits \u003C= 64\u0022 to check whether the bits are dynamically allocated. However, the check is incorrect and may cause a kmemleak as shown below:  unreferenced object 0xffff88812628c8c0 (size 32):   comm \u0022swapper/0\u0022, pid 1, jiffies 4294727320   hex dump (first 32 bytes): \tb0 c1 55 f5 81 88 ff ff f0 f0 f0 f0 f0 f0 f0 f0  ..U........... \tf0 f0 f0 f0 f0 f0 f0 f0 00 00 00 00 00 00 00 00  ..............   backtrace (crc 781e32cc): \t[\u003C00000000c452b4ab\u003E] kmemleak_alloc\u002B0x4b/0x80 \t[\u003C0000000004e09f80\u003E] __kmalloc_node_noprof\u002B0x480/0x5c0 \t[\u003C00000000597124d6\u003E] __alloc.isra.0\u002B0x89/0xb0 \t[\u003C000000004ebfffcd\u003E] alloc_bulk\u002B0x2af/0x720 \t[\u003C00000000d9c10145\u003E] prefill_mem_cache\u002B0x7f/0xb0 \t[\u003C00000000ff9738ff\u003E] bpf_mem_alloc_init\u002B0x3e2/0x610 \t[\u003C000000008b616eac\u003E] bpf_global_ma_init\u002B0x19/0x30 \t[\u003C00000000fc473efc\u003E] do_one_initcall\u002B0xd3/0x3c0 \t[\u003C00000000ec81498c\u003E] kernel_init_freeable\u002B0x66a/0x940 \t[\u003C00000000b119f72f\u003E] kernel_init\u002B0x20/0x160 \t[\u003C00000000f11ac9a7\u003E] ret_from_fork\u002B0x3c/0x70 \t[\u003C0000000004671da4\u003E] ret_from_fork_asm\u002B0x1a/0x30  That is because nr_bits will be set as zero in bpf_iter_bits_next() after all bits have been iterated.  Fix the issue by setting kit-\u003Ebit to kit-\u003Enr_bits instead of setting kit-\u003Enr_bits to zero when the iteration completes in bpf_iter_bits_next(). In addition, use \u0022!nr_bits || bits \u003E= nr_bits\u0022 to check whether the iteration is complete and still use \u0022nr_bits \u003E 64\u0022 to indicate whether bits are dynamically allocated. The \u0022!nr_bits\u0022 check is necessary because bpf_iter_bits_new() may fail before setting kit-\u003Enr_bits, and this condition will stop the iteration early instead of accessing the zeroed or freed kit-\u003Ebits.  Considering the initial value of kit-\u003Ebits is -1 and the type of kit-\u003Enr_bits is unsigned int, change the type of kit-\u003Enr_bits to int. The potential overflow problem will be handled in the following patch.",
  "published": "2024-11-09T11:15:11Z",
  "severity": "medium",
  "cvss": 5.5,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
  "epss": 0.00177,
  "epssPercentile": 0.07315,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.11.7-1",
      "fix": "DEBIAN-CVE-2024-50254",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2024-50254",
      "released": "2024-11-09T11:15:11Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "6.11.7-1",
      "fix": "DEBIAN-CVE-2024-50254",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2024-50254",
      "released": "2024-11-09T11:15:11Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T19:12:23Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}