CVE-2024-35905

A flaw was found in the Linux kernel. An integer overflow vulnerability exists in the access size of a stack, such that the size of the access stack can appear negative as a result of overflowing its signed int representation. This issue can result in denial of service.

This vulnerability is rated Moderate because exploitation requires local access with privileges to load eBPF programs, and the resulting verifier issue primarily causes a kernel crash leading to a denial of service. By default on Red Hat Enterprise Linux, unprivileged eBPF is disabled, requiring an attacker to already possess administrative privileges such as CAP_BPF or CAP_SYS_ADMIN to load crafted programs. Consequently, typical enterprise installations are not exposed to unprivileged local exploitation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.