{
  "schemaVersion": 1,
  "attribution": [
    {
      "source": "CISA Known Exploited Vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "licence": "US government work"
    },
    {
      "source": "GitHub Advisory Database",
      "url": "https://github.com/advisories",
      "licence": "CC BY 4.0"
    },
    {
      "source": "Have I Been Pwned",
      "url": "https://haveibeenpwned.com/",
      "licence": "CC BY 4.0"
    },
    {
      "source": "CVE Program (CVE records)",
      "url": "https://www.cve.org/Legal/TermsOfUse",
      "licence": "CVE Terms of Use",
      "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
      "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss/",
      "licence": "free to use; FIRST requests attribution"
    }
  ],
  "record": {
    "id": "CVE-2024-35894",
    "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2024-35894",
    "idYear": 2024,
    "status": "PUBLISHED",
    "publishedAt": "2024-05-19T08:34:49.504Z",
    "updatedAt": "2026-08-05T11:30:46.642Z",
    "importedAt": "2026-10-24T01:57:11.582Z",
    "snapshot": {
      "id": "cve_2026-10-24_midnight_baseline",
      "at": "2026-10-24T00:00:00.000Z",
      "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z"
    },
    "facts": {
      "title": "mptcp: prevent BPF accessing lowat from a subflow socket.",
      "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: prevent BPF accessing lowat from a subflow socket.\n\nAlexei reported the following splat:\n\n WARNING: CPU: 32 PID: 3276 at net/mptcp/subflow.c:1430 subflow_data_ready+0x147/0x1c0\n Modules linked in: dummy bpf_testmod(O) [last unloaded: bpf_test_no_cfi(O)]\n CPU: 32 PID: 3276 Comm: test_progs Tainted: GO       6.8.0-12873-g2c43c33bfd23\n Call Trace:\n  <TASK>\n  mptcp_set_rcvlowat+0x79/0x1d0\n  sk_setsockopt+0x6c0/0x1540\n  __bpf_setsockopt+0x6f/0x90\n  bpf_sock_ops_setsockopt+0x3c/0x90\n  bpf_prog_509ce5db2c7f9981_bpf_test_sockopt_int+0xb4/0x11b\n  bpf_prog_dce07e362d941d2b_bpf_test_socket_sockopt+0x12b/0x132\n  bpf_prog_348c9b5faaf10092_skops_sockopt+0x954/0xe86\n  __cgroup_bpf_run_filter_sock_ops+0xbc/0x250\n  tcp_connect+0x879/0x1160\n  tcp_v6_connect+0x50c/0x870\n  mptcp_connect+0x129/0x280\n  __inet_stream_connect+0xce/0x370\n  inet_stream_connect+0x36/0x50\n  bpf_trampoline_6442491565+0x49/0xef\n  inet_stream_connect+0x5/0x50\n  __sys_connect+0x63/0x90\n  __x64_sys_connect+0x14/0x20\n\nThe root cause of the issue is that bpf allows accessing mptcp-level\nproto_ops from a tcp subflow scope.\n\nFix the issue detecting the problematic call and preventing any action.",
      "affected": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "124a4885b55f3039c697feb53edc5ad88bf21161",
              "status": "affected",
              "versionType": "git",
              "lessThan": "ee3c845787b621cfe82c2e52c513024a9d7a78f5"
            },
            {
              "version": "5684ab1a0effbfeb706f47d85785f653005b97b1",
              "status": "affected",
              "versionType": "git",
              "lessThan": "3ffb1ab698376f09cc33101c07c1be229389fe29"
            },
            {
              "version": "5684ab1a0effbfeb706f47d85785f653005b97b1",
              "status": "affected",
              "versionType": "git",
              "lessThan": "fcf4692fa39e86a590c14a4af2de704e1d20a3b5"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "versions": [
            {
              "version": "6.7",
              "status": "affected"
            },
            {
              "version": "0",
              "status": "unaffected",
              "versionType": "semver",
              "lessThan": "6.7"
            },
            {
              "version": "6.8.5",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.8.*"
            },
            {
              "version": "6.9",
              "status": "unaffected",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ]
        }
      ]
    }
  }
}