CVE-2022-49548: bpf: Fix potential array overflow in bpf_trampoline_get_progs()

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-02-26 · updated 2026-06-17
Weakness: CWE-129

Description

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix potential array overflow in bpf_trampoline_get_progs() The cnt value in the 'cnt >= BPF_MAX_TRAMP_PROGS' check does not include BPF_TRAMP_MODIFY_RETURN bpf programs, so the number of the attached BPF_TRAMP_MODIFY_RETURN bpf programs in a trampoline can exceed BPF_MAX_TRAMP_PROGS. When this happens, the assignment '*progs++ = aux->prog' in bpf_trampoline_get_progs() will cause progs array overflow as the progs field in the bpf_tramp_progs struct can only hold at most BPF_MAX_TRAMP_PROGS bpf programs.

Affected products

Linux kernel: from 5.7 before 5.10.120; from 5.11 before 5.15.45; from 5.16 before 5.17.13; from 5.18 before 5.18.2 — fixed in 5.10.120, 5.15.45, 5.17.13, 5.18.2

How to fix

Upgrade to a fixed version: Linux kernel 5.10.120, 5.15.45, 5.17.13, 5.18.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-49548 or the next vulnerability affects your stack