CVE-2021-46974: bpf: Fix masking negation logic upon negative dst register

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-02-27 · updated 2026-08-04

Description

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix masking negation logic upon negative dst register The negation logic for the case where the off_reg is sitting in the dst register is not correct given then we cannot just invert the add to a sub or vice versa. As a fix, perform the final bitwise and-op unconditionally into AX from the off_reg, then move the pointer from the src to dst and finally use AX as the source for the original pointer arithmetic operation such that the inversion yields a correct result. The single non-AX mov in between is possible given constant blinding is retaining it as it's not an immediate based operation.

Affected products

Linux kernel: from 4.14.113 before 4.14.233; from 4.19.19 before 4.19.190; from 5.0 before 5.4.117; from 5.5 before 5.10.35; from 5.11 before 5.11.19; from 5.12 before 5.12.2 — fixed in 4.14.233, 4.19.190, 5.10.35, 5.11.19, 5.12.2, 5.4.117

How to fix

Upgrade to a fixed version: Linux kernel 4.14.233, 4.19.190, 5.10.35, 5.11.19. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-46974 or the next vulnerability affects your stack