CVE-2021-46974: bpf: Fix masking negation logic upon negative dst register
Vulnerability summary
CVE-2021-46974 is a high (CVSS 7.1) vulnerability in linux. EPSS estimates a 0.25% chance of exploitation in the next 30 days, higher than 16.3% of scored vulnerabilities.
Not severe (CVSS 7.1, local access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 6 · Related 6Timeline
- 27-02-2024PublishedVulnerability first disclosed.
- 05-08-2026Last modifiedVulnerability information updated.
Description
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix masking negation logic upon negative dst register The negation logic for the case where the off_reg is sitting in the dst register is not correct given then we cannot just invert the add to a sub or vice versa. As a fix, perform the final bitwise and-op unconditionally into AX from the off_reg, then move the pointer from the src to dst and finally use AX as the source for the original pointer arithmetic operation such that the inversion yields a correct result. The single non-AX mov in between is possible given constant blinding is retaining it as it's not an immediate based operation.
CVSS metrics
5 scores · 4 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated7.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
- OSV · DebianEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HDiffers
- NVDNIST5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HDiffers
EPSS trend
Probability
0.25%
Chance of exploitation in the next 30 days
Percentile
16%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.25% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Ubuntu85 products
- linux< 4.15.0-147.151 | < 5.4.0-77.86
- linux-allwinner-5.19All versions (No fix recorded)
- linux-aws< 4.15.0-1106.113 | < 5.4.0-1051.53
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.11All versions (No fix recorded)
Linux2 products
- linux≥ ae03b6b1c880a03d4771257336dc3bca156dd51b, < 4d542ddb88fb2f39bf7f14caa2902f3e8d06f6ba | ≥ f92a819b4cbef8c9527d9797110544b2055a4b96, < 0e2dfdc74a7f4036127356d42ea59388f153f42c | ≥ 979d63d50c0c0f7bc537bf821e056cc9fe5abd38, < 53e0db429b37a32b8fc706d0d90eb4583ad13848 | ≥ 979d63d50c0c0f7bc537bf821e056cc9fe5abd38, < 2cfa537674cd1051a3b8111536d77d0558f33d5d | ≥ 979d63d50c0c0f7bc537bf821e056cc9fe5abd38, < 6eba92a4d4be8feb4dc33976abac544fa99d6ecc | ≥ 979d63d50c0c0f7bc537bf821e056cc9fe5abd38, < 7cf64d8679ca1cb20cf57d6a88bfee79a0922a66 | ≥ 979d63d50c0c0f7bc537bf821e056cc9fe5abd38, < b9b34ddbe2076ade359cd5ce7537d5ed019e9807 | 078da99d449f64ca04d459cdbdcce513b64173cd | ≥ 4.14.113, < 4.14.233 | ≥ 4.19.19, < 4.19.190 | ≥ 4.20.6, < 4.21 | 5.0
- linux_kernel≥ 4.14.113, < 4.14.233 | ≥ 4.19.19, < 4.19.190 | ≥ 5.0, < 5.4.117 | ≥ 5.5, < 5.10.35 | ≥ 5.11, < 5.11.19 | ≥ 5.12, < 5.12.2
Debian1 product
- linux< 5.10.38-1
3 vendors · 88 products
