What is the CVSS score of CVE-2024-27050?

CVE-2024-27050 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Linux Kernel are affected by CVE-2024-27050?

CVE-2024-27050 introduces a memory corruption vulnerability in Linux kernel libbpf that enables local privilege escalation, affecting any organization running systems or containers with vulnerable…. A patch is available.

How to fix or mitigate CVE-2024-27050?

Within 24 hours: Identify all systems, containers, and development environments running libbpf by querying package managers and container registries for the installed version. Within 7 days: Apply the vendor-released patch across non-production environments and complete testing to verify application and workload stability. Within 30 days: Deploy the patched libbpf version to all production systems and cloud infrastructure, prioritizing systems with multi-user access or running untrusted code, and validate remediation via vulnerability scanning.

Linux Kernel CVE-2024-27050

HIGH

Out-of-bounds Write (CWE-787)

2024-05-01 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Buffer Overflow Linux Memory Corruption

7.8

CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

ABI mismatch between binary and runtime is a non-default environmental precondition justifying AC:H; local low-privilege access confirmed by description and CVSS vector.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 04, 2026 - 13:02 vuln.today

v3 (cvss_changed)

Analysis Updated

Aug 04, 2026 - 13:00 vuln.today

v2 (cvss_changed)

Analysis Updated

Aug 04, 2026 - 13:00 vuln.today

v1 (cvss_changed)

Re-analysis Queued

Aug 04, 2026 - 11:23 vuln.today

cvss_changed

Severity Changed

Aug 04, 2026 - 11:23 NVD

MEDIUM HIGH

CVSS changed

Aug 04, 2026 - 11:23 NVD

5.5 (MEDIUM) 7.8 (HIGH)

CVE Published

May 01, 2024 - 13:15 cve.org

MEDIUM 5.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

libbpf: Use OPTS_SET() macro in bpf_xdp_query()

When the feature_flags and xdp_zc_max_segs fields were added to the libbpf bpf_xdp_query_opts, the code writing them did not use the OPTS_SET() macro. This causes libbpf to write to those fields unconditionally, which means that programs compiled against an older version of libbpf (with a smaller size of the bpf_xdp_query_opts struct) will have its stack corrupted by libbpf writing out of bounds.

The patch adding the feature_flags field has an early bail out if the feature_flags field is not part of the opts struct (via the OPTS_HAS) macro, but the patch adding xdp_zc_max_segs does not. For consistency, this fix just changes the assignments to both fields to use the OPTS_SET() macro.

AnalysisAI

Stack corruption in Linux kernel libbpf's bpf_xdp_query() function can corrupt adjacent stack memory in programs that call this API with an older libbpf ABI. The root cause is the absence of the OPTS_SET() macro when writing feature_flags and xdp_zc_max_segs to bpf_xdp_query_opts, causing unconditional out-of-bounds writes into callers compiled against a smaller version of the struct. No public exploit has been identified and EPSS sits at 0.27%, but the CVSS 7.8 High rating reflects the potential for full privilege escalation via stack corruption in a local context.

Technical ContextAI

The vulnerability resides in libbpf, the userspace BPF (Berkeley Packet Filter) library shipped with the Linux kernel, specifically in the bpf_xdp_query() function used to query XDP (eXpress Data Path) interface settings. When the feature_flags and xdp_zc_max_segs fields were introduced to the bpf_xdp_query_opts struct, the implementation wrote to them without using the OPTS_SET() macro. OPTS_SET() internally relies on OPTS_HAS() to verify that the caller's struct size includes the target field before writing - a critical backward-compatibility guard for libbpf's versioned opts pattern. Skipping this guard causes libbpf to write beyond the caller's struct boundary, corrupting whatever lies adjacent on the stack. CWE-787 (Out-of-Bounds Write) precisely classifies the root cause. Affected products span the Linux kernel across multiple stable branches per CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*.

RemediationAI

Apply the upstream kernel patches from the four stable-branch commits available at https://git.kernel.org/stable/c/682ddd62abd4bdcee7584246903e7a2df005fe0d, https://git.kernel.org/stable/c/92a871ab9fa59a74d013bc04f321026a057618e7, https://git.kernel.org/stable/c/cd3be9843247edb8fc6fcd8d8237cbce2bc19f5e, and https://git.kernel.org/stable/c/fa5bef5e80c6a3321b2b1a7070436f3bc5daf07c. Distribution vendors (Red Hat, Ubuntu, Debian, SUSE) will typically backport these into their stable kernel packages; applying the latest kernel update from your distribution is the recommended path. Note: the exact patched kernel release version number is not independently confirmed from available data - verify with your distribution's security advisory. As a compensating control in environments that cannot immediately update, ensure all programs invoking bpf_xdp_query() are recompiled and relinked against the same libbpf version present at runtime; this eliminates the ABI size mismatch that triggers the out-of-bounds write, though it does not fix the underlying library defect. Restricting execution of XDP-querying programs to trusted users via capability controls (CAP_NET_ADMIN or CAP_SYS_ADMIN as appropriate) reduces exposure surface but does not remediate the vulnerability.