CVE-2024-53125: Linux Kernel Privilege Escalation Flaw

CVE-2024-53125 Overview

CVE-2024-53125 is a Linux kernel vulnerability in the Berkeley Packet Filter (BPF) verifier. The flaw resides in the sync_linked_regs() function, where range propagation incorrectly overrides subreg_def marks on linked registers. When the BPF_F_TEST_RND_HI32 flag is set, the verifier rewrites eligible BPF programs incorrectly, causing missing zero-extension for the upper register half on architectures that require it. Local users with the ability to load BPF programs can trigger unexpected register state, leading to kernel instability. The issue affects Linux kernel 6.12-rc1 through 6.12-rc3 and other maintained branches receiving the backport.

Critical Impact
A local, low-privileged user capable of loading BPF programs can trigger BPF verifier rewrites that corrupt register state and impact kernel availability.

Affected Products

Linux kernel 6.12-rc1
Linux kernel 6.12-rc2
Linux kernel 6.12-rc3

Discovery Timeline

2024-12-04 - CVE-2024-53125 published to the National Vulnerability Database
2025-03 - Debian LTS security announcements published
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-53125

Vulnerability Analysis

The defect lives in the BPF verifier's register linkage logic. When the verifier propagates range information across linked registers via sync_linked_regs(), it invokes copy_register_state(), which overwrites the destination register's subreg_def marker. The marker records where a subregister write occurred so that later analysis can insert required zero-extension instructions.

After the marker is lost, mark_insn_zext() cannot identify the original subregister write as needing zero extension. When the kernel is built or loaded with BPF_F_TEST_RND_HI32, the verifier deliberately injects random values into the upper 32 bits of subregister writes to stress-test JIT correctness. Without the preserved marker, that random hi32 pattern is not scrubbed before subsequent reads. The result is that a subsequent 64-bit read of the register returns garbage in the upper half instead of a properly zero-extended value.

Root Cause

The root cause is a state-tracking error in the BPF verifier. sync_linked_regs() was not preserving the subreg_def field when copying register state during range synchronization. This violates an invariant relied on by the zero-extension insertion pass and by architectures that require explicit zero extension of subregister writes.

Attack Vector

Exploitation requires local access and the ability to load a BPF program, which typically requires CAP_BPF or CAP_SYS_ADMIN. On systems where unprivileged BPF is enabled or where a low-privileged service accepts user-supplied BPF, an attacker can craft a program that triggers the incorrect rewrite. The resulting register corruption impacts kernel availability. No public proof-of-concept is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2024-53125

Indicators of Compromise

Unexpected kernel warnings or panics tied to BPF program loading or execution on kernels within the affected 6.12-rc range.
Anomalous bpf(2) syscall activity from non-administrative users or unexpected processes.
Kernel builds configured with BPF_F_TEST_RND_HI32 operating outside development or test environments.

Detection Strategies

Inventory running kernels and flag hosts on Linux 6.12-rc1, 6.12-rc2, or 6.12-rc3 as well as unpatched stable branches referenced in the kernel.org commits.
Audit which user accounts and containers hold CAP_BPF or CAP_SYS_ADMIN and can therefore invoke bpf(BPF_PROG_LOAD, ...).
Monitor auditd rules for bpf syscalls issued by unexpected UIDs.

Monitoring Recommendations

Enable Linux audit rules for the bpf syscall and forward them to a centralized log platform for correlation.
Alert on kernel oops, warnings, or verifier rejection spikes that reference sync_linked_regs, copy_register_state, or mark_insn_zext.
Track kernel package versions across the fleet and alert when hosts drift from the vendor-patched baseline.

How to Mitigate CVE-2024-53125

Immediate Actions Required

Apply the upstream fix by updating to a kernel that includes the patches referenced by kernel.org commits 60fd3538, b57ac2d9, bfe9446e, dadf82c1, e2ef0f31, and e9bd9c49.
Debian LTS users should install the updates announced in the March 2025 Debian LTS Announcement #1 and Debian LTS Announcement #2.
Restrict BPF program loading to trusted administrators and disable unprivileged BPF where feasible.

Patch Information

The fix ensures sync_linked_regs() preserves the subreg_def field so that mark_insn_zext() correctly inserts zero-extension instructions. Distribution-supplied patches are available via the kernel.org stable tree commit e9bd9c49 and companion backports.

Workarounds

Set kernel.unprivileged_bpf_disabled=1 via sysctl to block BPF program loading by unprivileged users.
Do not deploy production kernels built with the BPF_F_TEST_RND_HI32 test flag.
Use seccomp or Linux Security Modules to deny the bpf(2) syscall for workloads that do not require it.

bash

# Configuration example
# Disable unprivileged BPF program loading
sysctl -w kernel.unprivileged_bpf_disabled=1
echo 'kernel.unprivileged_bpf_disabled=1' >> /etc/sysctl.d/99-bpf-hardening.conf

# Verify current kernel version
uname -r