Answer in brief
CVE-2024-38662 records a Unknown severity vulnerability in bpf: Allow delete from sockmap/sockhash only if update is allowed. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic), Siemens/RUGGEDCOM RST2428P (generic), Siemens/SCALANCE XCM-/XRM-/XCH-/XRH-300 family (generic) and additional mapped packages. Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic), Siemens/RUGGEDCOM RST2428P (generic), Siemens/SCALANCE XCM-/XRM-/XCH-/XRH-300 family (generic) and additional mapped packages. Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=dd54b48db0c822ae7b520bc80751f0a0a173ef75 <29467edc23818dc5a33042ffb4920b49b090e63d || >=d1e73fb19a4c872d7a399ad3c66e8ca30e0875ec <11e8ecc5b86037fec43d07b1c162e233e131b1d9 || >=a44770fed86515eedb5a7c00b787f847ebb134a5 <6693b172f008846811f48a099f33effc26068e1e || >=668b3074aa14829e2ac2759799537a93b60fef86 <000a65bf1dc04fb2b65e2abf116f0bc0fc2ee7b1 || >=ff91059932401894e6c86341915615c5eb0eca48 <b81e1c5a3c70398cf76631ede63a03616ed1ba3c || >=ff91059932401894e6c86341915615c5eb0eca48 <98e948fb60d41447fd8d2d0c3b8637fc6b6dc26d || f7990498b05ac41f7d6a190dc0418ef1d21bf058 || 6af057ccdd8e7619960aca1f0428339f213b31cd || >=5.10.215 <5.10.219 || >=5.15.154 <5.15.161 || >=6.1.85 <6.1.93 || >=6.6.26 <6.6.33 || >=5.4.274 <5.5 || >=6.8.5 <6.9 | 29467edc23818dc5a33042ffb4920b49b090e63d, 11e8ecc5b86037fec43d07b1c162e233e131b1d9, 6693b172f008846811f48a099f33effc26068e1e, 000a65bf1dc04fb2b65e2abf116f0bc0fc2ee7b1, b81e1c5a3c70398cf76631ede63a03616ed1ba3c, 98e948fb60d41447fd8d2d0c3b8637fc6b6dc26d, 5.10.219, 5.15.161, 6.1.93, 6.6.33, 5.5, 6.9 |
| Linux/Linuxgeneric | 6.9 | Not reported |
| Siemens/RUGGEDCOM RST2428Pgeneric | >=0 <V3.1 | V3.1 |
| Siemens/SCALANCE XCM-/XRM-/XCH-/XRH-300 familygeneric | >=0 <V3.1 | V3.1 |
| Siemens/SIMATIC S7-1500 TM MFP - GNU/Linux subsystemgeneric | >=0 <V1.1.1 | V1.1.1 |
Published upstream
Jun 21, 2024
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 15, 2026
In the Linux kernel, the following vulnerability has been resolved: bpf: Allow delete from sockmap/sockhash only if update is allowed We have seen an influx of syzkaller reports where a BPF program attached to a tracepoint triggers a locking rule violation by performing a map_delete on a sockmap/sockhash. We don't intend to support this artificial use scenario. Extend the existing verifier allowed-program-type check for updating sockmap/sockhash to also cover deleting from a map. From now on only BPF programs which were previously allowed to update sockmap/sockhash can delete from these map types.
Quoted source text, attributed separately from HOL analysis.