GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-50132 (GCVE-0-2024-50132)

Vulnerability from cvelistv5 – Published: 2024-11-05 17:10 – Updated: 2026-08-05 11:41
VLAI
Title
tracing/probes: Fix MAX_TRACE_ARGS limit handling
Summary
In the Linux kernel, the following vulnerability has been resolved: tracing/probes: Fix MAX_TRACE_ARGS limit handling When creating a trace_probe we would set nr_args prior to truncating the arguments to MAX_TRACE_ARGS. However, we would only initialize arguments up to the limit. This caused invalid memory access when attempting to set up probes with more than 128 fetchargs. BUG: kernel NULL pointer dereference, address: 0000000000000020 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: Oops: 0000 [#1] PREEMPT SMP PTI CPU: 0 UID: 0 PID: 1769 Comm: cat Not tainted 6.11.0-rc7+ #8 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-1.fc39 04/01/2014 RIP: 0010:__set_print_fmt+0x134/0x330 Resolve the issue by applying the MAX_TRACE_ARGS limit earlier. Return an error when there are too many arguments instead of silently truncating.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-10-01 20:21 UTC
CWE
  • CWE-476 - NULL Pointer Dereference
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: e96b42d22f66982b84e31b6935a59d74d9a2d848 , < 6bc24db74fe4788cc7c2f30a113fc6aafba225a3 (git)
Affected: 035ba76014c096316fa809a46ce0a1b9af1cde0d , < 08ccd1a57c4d3882e9a877eb2dcc66e50a3b0279 (git)
Affected: 035ba76014c096316fa809a46ce0a1b9af1cde0d , < 73f35080477e893aa6f4c8d388352b871b288fbc (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.9
Unaffected: 0 , < 6.9 (semver)
Unaffected: 6.11.6 , ≤ 6.11.* (semver)
Unaffected: 6.12 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-50132",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T20:21:27.012103Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-476",
                "description": "CWE-476 NULL Pointer Dereference",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T20:27:15.256Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/trace/trace_eprobe.c",
            "kernel/trace/trace_fprobe.c",
            "kernel/trace/trace_kprobe.c",
            "kernel/trace/trace_uprobe.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6bc24db74fe4788cc7c2f30a113fc6aafba225a3",
              "status": "affected",
              "version": "e96b42d22f66982b84e31b6935a59d74d9a2d848",
              "versionType": "git"
            },
            {
              "lessThan": "08ccd1a57c4d3882e9a877eb2dcc66e50a3b0279",
              "status": "affected",
              "version": "035ba76014c096316fa809a46ce0a1b9af1cde0d",
              "versionType": "git"
            },
            {
              "lessThan": "73f35080477e893aa6f4c8d388352b871b288fbc",
              "status": "affected",
              "version": "035ba76014c096316fa809a46ce0a1b9af1cde0d",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/trace/trace_eprobe.c",
            "kernel/trace/trace_fprobe.c",
            "kernel/trace/trace_kprobe.c",
            "kernel/trace/trace_uprobe.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.9"
            },
            {
              "lessThan": "6.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.6",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing/probes: Fix MAX_TRACE_ARGS limit handling\n\nWhen creating a trace_probe we would set nr_args prior to truncating the\narguments to MAX_TRACE_ARGS. However, we would only initialize arguments\nup to the limit.\n\nThis caused invalid memory access when attempting to set up probes with\nmore than 128 fetchargs.\n\n  BUG: kernel NULL pointer dereference, address: 0000000000000020\n  #PF: supervisor read access in kernel mode\n  #PF: error_code(0x0000) - not-present page\n  PGD 0 P4D 0\n  Oops: Oops: 0000 [#1] PREEMPT SMP PTI\n  CPU: 0 UID: 0 PID: 1769 Comm: cat Not tainted 6.11.0-rc7+ #8\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-1.fc39 04/01/2014\n  RIP: 0010:__set_print_fmt+0x134/0x330\n\nResolve the issue by applying the MAX_TRACE_ARGS limit earlier. Return\nan error when there are too many arguments instead of silently\ntruncating."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached only by writing a probe definition to tracefs files (/sys/kernel/tracing/kprobe_events, uprobe_events, or dynamic_events) via the write() syscall. There is no remote or network-facing path to __trace_kprobe_create()/__trace_uprobe_create().\nAC:L - A single write() containing more than 128 fetchargs deterministically triggers the NULL dereference in __set_print_fmt() \u2014 no race, no memory-layout dependency, and the 4096-byte WRITE_BUFSIZE line limit easily accommodates 129+ arguments.\nPR:L - No capable()/CAP_SYS_ADMIN check exists anywhere in the tracefs or dynamic-event path; access is gated purely by file permissions, which distros, Android/ChromeOS-style tracing groups, and container/debug setups routinely relax for non-root tracing users. Consistent with prior kernel CNA scoring of tracefs-write-triggered tracing bugs as PR:L.\nUI:N - The attacker performs the entire operation themselves with one write() to the tracefs event file; no victim action, mount, or file open by another user is needed.\nS:U - The uninitialized-argument dereference and its consequences are entirely within the kernel\u0027s own security authority \u2014 no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The code treats a zeroed, never-initialized struct probe_arg as valid and chases its pointers (parg-\u003etype-\u003efmt, -\u003eis_string, -\u003eprint), so on configurations where low addresses are mappable (mmap_min_addr=0, common on embedded and legacy deployments) the attacker controls the fetch_type and turns snprintf(\"%s\", parg-\u003etype-\u003efmt) into an arbitrary kernel-memory read whose output is then exposed through the event\u0027s format file.\nI:H - __set_print_fmt() runs twice \u2014 once to size the kmalloc buffer and once to fill it \u2014 so an attacker-controlled type structure yielding different lengths between passes gives a controlled heap buffer overflow, and the same uninitialized-pointer dereference reaches an indirect call through parg-\u003etype-\u003eprint in trace_probe_print_args().\nA:H - The immediate result is a kernel oops (NULL read at 0x20 in __set_print_fmt), and when triggered through dynamic_events the faulting task dies while holding dyn_event_ops_mutex, permanently deadlocking all further dynamic-event operations until reboot; with panic_on_oops set it is a full system panic."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:41:57.393Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6bc24db74fe4788cc7c2f30a113fc6aafba225a3"
        },
        {
          "url": "https://git.kernel.org/stable/c/08ccd1a57c4d3882e9a877eb2dcc66e50a3b0279"
        },
        {
          "url": "https://git.kernel.org/stable/c/73f35080477e893aa6f4c8d388352b871b288fbc"
        }
      ],
      "title": "tracing/probes: Fix MAX_TRACE_ARGS limit handling",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-50132",
    "datePublished": "2024-11-05T17:10:57.625Z",
    "dateReserved": "2024-10-21T19:36:19.955Z",
    "dateUpdated": "2026-08-05T11:41:57.393Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-50132",
      "date": "2026-09-17",
      "epss": "0.00224",
      "percentile": "0.13222"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-50132\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-11-05T18:15:15.973\",\"lastModified\":\"2026-08-04T11:21:24.010\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ntracing/probes: Fix MAX_TRACE_ARGS limit handling\\n\\nWhen creating a trace_probe we would set nr_args prior to truncating the\\narguments to MAX_TRACE_ARGS. However, we would only initialize arguments\\nup to the limit.\\n\\nThis caused invalid memory access when attempting to set up probes with\\nmore than 128 fetchargs.\\n\\n  BUG: kernel NULL pointer dereference, address: 0000000000000020\\n  #PF: supervisor read access in kernel mode\\n  #PF: error_code(0x0000) - not-present page\\n  PGD 0 P4D 0\\n  Oops: Oops: 0000 [#1] PREEMPT SMP PTI\\n  CPU: 0 UID: 0 PID: 1769 Comm: cat Not tainted 6.11.0-rc7+ #8\\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-1.fc39 04/01/2014\\n  RIP: 0010:__set_print_fmt+0x134/0x330\\n\\nResolve the issue by applying the MAX_TRACE_ARGS limit earlier. Return\\nan error when there are too many arguments instead of silently\\ntruncating.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: rastreo/sondas: Se corrige el manejo del l\u00edmite MAX_TRACE_ARGS Al crear un trace_probe, establecer\u00edamos nr_args antes de truncar los argumentos a MAX_TRACE_ARGS. Sin embargo, solo inicializar\u00edamos los argumentos hasta el l\u00edmite. Esto causaba un acceso no v\u00e1lido a la memoria al intentar configurar sondas con m\u00e1s de 128 fetchargs. ERROR: desreferencia de puntero NULL del kernel, direcci\u00f3n: 0000000000000020 #PF: acceso de lectura del supervisor en modo kernel #PF: error_code(0x0000) - p\u00e1gina no presente PGD 0 P4D 0 Oops: Oops: 0000 [#1] PREEMPT SMP PTI CPU: 0 UID: 0 PID: 1769 Comm: cat No contaminado 6.11.0-rc7+ #8 Nombre del hardware: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-1.fc39 04/01/2014 RIP: 0010:__set_print_fmt+0x134/0x330 Resuelva el problema aplicando el l\u00edmite MAX_TRACE_ARGS anteriormente. Devuelva un error cuando haya demasiados argumentos en lugar de truncarlos silenciosamente.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"kernel/trace/trace_eprobe.c\",\"kernel/trace/trace_fprobe.c\",\"kernel/trace/trace_kprobe.c\",\"kernel/trace/trace_uprobe.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"e96b42d22f66982b84e31b6935a59d74d9a2d848\",\"lessThan\":\"6bc24db74fe4788cc7c2f30a113fc6aafba225a3\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"035ba76014c096316fa809a46ce0a1b9af1cde0d\",\"lessThan\":\"08ccd1a57c4d3882e9a877eb2dcc66e50a3b0279\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"035ba76014c096316fa809a46ce0a1b9af1cde0d\",\"lessThan\":\"73f35080477e893aa6f4c8d388352b871b288fbc\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"kernel/trace/trace_eprobe.c\",\"kernel/trace/trace_fprobe.c\",\"kernel/trace/trace_kprobe.c\",\"kernel/trace/trace_uprobe.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.9\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.9\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.11.6\",\"lessThanOrEqual\":\"6.11.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-10-01T20:21:27.012103Z\",\"id\":\"CVE-2024-50132\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.9\",\"versionEndExcluding\":\"6.11.6\",\"matchCriteriaId\":\"2132686D-AA83-479C-98CA-4B9F24436525\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"7F361E1D-580F-4A2D-A509-7615F73167A1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"925478D0-3E3D-4E6F-ACD5-09F28D5DF82C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"3C95E234-D335-4B6C-96BF-E2CEBD8654ED\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"E0F717D8-3014-4F84-8086-0124B2111379\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/08ccd1a57c4d3882e9a877eb2dcc66e50a3b0279\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6bc24db74fe4788cc7c2f30a113fc6aafba225a3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/73f35080477e893aa6f4c8d388352b871b288fbc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-13T18:33:23+00:00",
      "cve": "CVE-2024-50132",
      "id": "CVE-2024-50132",
      "initial_release_date": "2024-11-05T00:00:00+00:00",
      "product_status:known_affected": "42",
      "product_status:known_not_affected": "156",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: tracing/probes: Fix MAX_TRACE_ARGS limit handling",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-50132.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.5, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-50132\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-10-01T20:21:27.012103Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-476\", \"description\": \"CWE-476 NULL Pointer Dereference\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-10-01T15:16:44.884Z\"}}], \"cna\": {\"title\": \"tracing/probes: Fix MAX_TRACE_ARGS limit handling\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"e96b42d22f66982b84e31b6935a59d74d9a2d848\", \"lessThan\": \"6bc24db74fe4788cc7c2f30a113fc6aafba225a3\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"035ba76014c096316fa809a46ce0a1b9af1cde0d\", \"lessThan\": \"08ccd1a57c4d3882e9a877eb2dcc66e50a3b0279\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"035ba76014c096316fa809a46ce0a1b9af1cde0d\", \"lessThan\": \"73f35080477e893aa6f4c8d388352b871b288fbc\", \"versionType\": \"git\"}], \"programFiles\": [\"kernel/trace/trace_eprobe.c\", \"kernel/trace/trace_fprobe.c\", \"kernel/trace/trace_kprobe.c\", \"kernel/trace/trace_uprobe.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.9\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.9\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.11.6\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.11.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"kernel/trace/trace_eprobe.c\", \"kernel/trace/trace_fprobe.c\", \"kernel/trace/trace_kprobe.c\", \"kernel/trace/trace_uprobe.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/6bc24db74fe4788cc7c2f30a113fc6aafba225a3\"}, {\"url\": \"https://git.kernel.org/stable/c/08ccd1a57c4d3882e9a877eb2dcc66e50a3b0279\"}, {\"url\": \"https://git.kernel.org/stable/c/73f35080477e893aa6f4c8d388352b871b288fbc\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ntracing/probes: Fix MAX_TRACE_ARGS limit handling\\n\\nWhen creating a trace_probe we would set nr_args prior to truncating the\\narguments to MAX_TRACE_ARGS. However, we would only initialize arguments\\nup to the limit.\\n\\nThis caused invalid memory access when attempting to set up probes with\\nmore than 128 fetchargs.\\n\\n  BUG: kernel NULL pointer dereference, address: 0000000000000020\\n  #PF: supervisor read access in kernel mode\\n  #PF: error_code(0x0000) - not-present page\\n  PGD 0 P4D 0\\n  Oops: Oops: 0000 [#1] PREEMPT SMP PTI\\n  CPU: 0 UID: 0 PID: 1769 Comm: cat Not tainted 6.11.0-rc7+ #8\\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-1.fc39 04/01/2014\\n  RIP: 0010:__set_print_fmt+0x134/0x330\\n\\nResolve the issue by applying the MAX_TRACE_ARGS limit earlier. Return\\nan error when there are too many arguments instead of silently\\ntruncating.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11.6\", \"versionStartIncluding\": \"6.9\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12\", \"versionStartIncluding\": \"6.9\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-05-04T09:46:52.372Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-50132\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-10-01T20:27:15.256Z\", \"dateReserved\": \"2024-10-21T19:36:19.955Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-11-05T17:10:57.625Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.