Log in Start free

Vulnerability · Published Jul 12, 2024 · Assigned by Linux

CVE-2024-40940net/mlx5: Fix tainted pointer delete is case of flow rules creation fail

High 7.8

In plain English

A high-severity security flaw in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)7.8High
Exploit odds (30 days)0.3%top 82.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix tainted pointer delete is case of flow rules creation fail In case of flow rule creation fail in mlx5_lag_create_port_sel_table(), instead of previously created rules, the tainted pointer is deleted deveral times. Fix this bug by using correct flow rules pointers. Found by Linux Verification Center (linuxtesting.org) with SVACE.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12linux6.1.99-1DEBIAN-CVE-2024-40940
Debian:13linux6.9.7-1DEBIAN-CVE-2024-40940
Debian:14linux6.9.7-1DEBIAN-CVE-2024-40940
Ubuntu:24.04:LTSlinux6.8.0-44.44UBUNTU-CVE-2024-40940
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2024-40940
Ubuntu:24.04:LTSlinux-aws6.8.0-1015.16UBUNTU-CVE-2024-40940
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2024-40940
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2024-40940
Ubuntu:22.04:LTSlinux-aws-6.5no fix listedUBUNTU-CVE-2024-40940
Ubuntu:22.04:LTSlinux-aws-6.86.8.0-1015.16~22.04.1UBUNTU-CVE-2024-40940
Ubuntu:24.04:LTSlinux-azure6.8.0-1014.16UBUNTU-CVE-2024-40940
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2024-40940
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2024-40940
Ubuntu:22.04:LTSlinux-azure-6.5no fix listedUBUNTU-CVE-2024-40940
Ubuntu:22.04:LTSlinux-azure-6.86.8.0-1014.16~22.04.1UBUNTU-CVE-2024-40940
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2024-40940
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2024-40940
Ubuntu:24.04:LTSlinux-gcp6.8.0-1014.16UBUNTU-CVE-2024-40940
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2024-40940
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2024-40940
Ubuntu:22.04:LTSlinux-gcp-6.5no fix listedUBUNTU-CVE-2024-40940
Ubuntu:22.04:LTSlinux-gcp-6.86.8.0-1014.16~22.04.1UBUNTU-CVE-2024-40940
Ubuntu:24.04:LTSlinux-gke6.8.0-1010.13UBUNTU-CVE-2024-40940
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2024-40940
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2024-40940
Ubuntu:22.04:LTSlinux-hwe-6.5no fix listedUBUNTU-CVE-2024-40940
Ubuntu:22.04:LTSlinux-hwe-6.86.8.0-45.45~22.04.1UBUNTU-CVE-2024-40940
Ubuntu:24.04:LTSlinux-ibm6.8.0-1012.12UBUNTU-CVE-2024-40940
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2024-40940
Ubuntu:24.04:LTSlinux-lowlatency6.8.0-44.44.1UBUNTU-CVE-2024-40940
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2024-40940
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2024-40940
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.5no fix listedUBUNTU-CVE-2024-40940
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.86.8.0-44.44.1~22.04.1UBUNTU-CVE-2024-40940
Ubuntu:24.04:LTSlinux-nvidia6.8.0-1013.14UBUNTU-CVE-2024-40940
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2024-40940
Ubuntu:22.04:LTSlinux-nvidia-6.5no fix listedUBUNTU-CVE-2024-40940
Ubuntu:22.04:LTSlinux-nvidia-6.86.8.0-1013.14~22.04.1UBUNTU-CVE-2024-40940
Ubuntu:24.04:LTSlinux-nvidia-lowlatency6.8.0-1013.14.1UBUNTU-CVE-2024-40940
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2024-40940
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2024-40940
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2024-40940
Ubuntu:22.04:LTSlinux-oem-6.5no fix listedUBUNTU-CVE-2024-40940
Ubuntu:24.04:LTSlinux-oem-6.86.8.0-1012.12UBUNTU-CVE-2024-40940
Ubuntu:24.04:LTSlinux-oracle6.8.0-1012.12UBUNTU-CVE-2024-40940
Ubuntu:22.04:LTSlinux-oracle-6.5no fix listedUBUNTU-CVE-2024-40940
Ubuntu:22.04:LTSlinux-oracle-6.86.8.0-1012.12~22.04.1UBUNTU-CVE-2024-40940
Ubuntu:24.04:LTSlinux-raspi6.8.0-1011.12UBUNTU-CVE-2024-40940
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2024-40940
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2024-40940
Ubuntu:24.04:LTSlinux-riscv6.8.0-44.44.1UBUNTU-CVE-2024-40940
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2024-40940
Ubuntu:22.04:LTSlinux-riscv-6.5no fix listedUBUNTU-CVE-2024-40940
Ubuntu:22.04:LTSlinux-riscv-6.86.8.0-44.44.1~22.04.1UBUNTU-CVE-2024-40940
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2024-40940
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2024-40940
Ubuntu:22.04:LTSlinux-starfive-6.5no fix listedUBUNTU-CVE-2024-40940

Affected products (as reported)

VendorProductVersions
Linux Linux 352899f384d4aefa77ede6310d08c1b515612a8f – before 531eab2da27dd42d68dfb841d82e987f4a6738b8352899f384d4aefa77ede6310d08c1b515612a8f – before d857df86837ac1c30592e8a068204d16feac9930352899f384d4aefa77ede6310d08c1b515612a8f – before a03a3fa12769e25f4385bee587afe1445aee7f7a352899f384d4aefa77ede6310d08c1b515612a8f – before 229bedbf62b13af5aba6525ad10b62ad38d9ccb5
Linux Linux 5.19

References