CVE-2024-40909

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-40909", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-07-12T12:17:45.580Z", "datePublished": "2024-07-12T12:20:48.447Z", "dateUpdated": "2026-10-30T12:18:36.759Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:18:36.759Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix a potential use-after-free in bpf_link_free()\n\nAfter commit 1a80dbcb2dba, bpf_link can be freed by\nlink->ops->dealloc_deferred, but the code still tests and uses\nlink->ops->dealloc afterward, which leads to a use-after-free as\nreported by syzbot. Actually, one of them should be sufficient, so\njust call one of them instead of both. Also add a WARN_ON() in case\nof any problematic implementation."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerability is reached exclusively through the local `bpf()` syscall \u2014 creating a raw_tracepoint/kprobe_multi/uprobe_multi link and then closing its file descriptor. No network or remote-peer data is involved.\nAC:L - The attacker drives the free side directly and can repeat the create/close cycle in an unbounded loop across all CPUs while generating scheduling and RCU load to force preemption between `call_rcu()` and the stale `link->ops` read; syzbot triggered it in practice, so the window is reachable without relying on conditions outside attacker influence.\nPR:L - `bpf_token_capable()` grants BPF/PERFMON at `ns_capable()` level when a BPF token is delegated (kernel/bpf/token.c:17-28), so a process unprivileged in the init namespace inside a container can load these tracing programs and create the affected links; the same path is reachable by ordinary non-root service accounts holding only CAP_BPF+CAP_PERFMON, which is not administrative control of the host.\nUI:N - The entire sequence \u2014 link creation and fd close \u2014 is performed by the attacker's own process with no action required from any other user.\nS:U - The corruption and its consequences are confined to the kernel's own memory and privilege domain; no hypervisor, IOMMU, or other security-authority boundary is crossed.\nC:H - The use-after-free reads the `ops` pointer out of a freed slab object that the attacker can reallocate and fill via heap spraying, yielding an arbitrary kernel pointer dereference and an arbitrary-read primitive over kernel memory.\nI:H - After the stale `link->ops` read, the code performs `link->ops->dealloc(link)` \u2014 an indirect call through an attacker-controlled function pointer table, giving control-flow hijack and full kernel-integrity compromise.\nA:H - Even unweaponized, dereferencing and calling through a freed/recycled `ops` pointer produces a wild indirect branch and immediate kernel oops or panic, and the attacker can trigger it repeatedly."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/bpf/syscall.c"], "versions": [{"version": "ac48dc6ac9240f73bf08d29edf65c2deca93ee5d", "lessThan": "e8ccda39b395169622855607085cdeef4d376e0f", "status": "affected", "versionType": "git"}, {"version": "876941f533e7b47fc69977fc4551c02f2d18af97", "lessThan": "91cff53136daeff50816b0baeafd38a6976f6209", "status": "affected", "versionType": "git"}, {"version": "1a80dbcb2dbaf6e4c216e62e30fa7d3daa8001ce", "lessThan": "fa97b8fed9896f1e89cb657513e483a152d4c382", "status": "affected", "versionType": "git"}, {"version": "1a80dbcb2dbaf6e4c216e62e30fa7d3daa8001ce", "lessThan": "2884dc7d08d98a89d8d65121524bb7533183a63a", "status": "affected", "versionType": "git"}, {"version": "5d8d447777564b35f67000e7838e7ccb64d525c8", "status": "affected", "versionType": "git"}, {"version": "6.6.26", "lessThan": "6.6.35", "status": "affected", "versionType": "semver"}, {"version": "6.8.5", "lessThan": "6.9", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/bpf/syscall.c"], "versions": [{"version": "6.9", "status": "affected"}, {"version": "0", "lessThan": "6.9", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.35", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.9.6", "lessThanOrEqual": "6.9.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.10", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6.26", "versionEndExcluding": "6.6.35"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9", "versionEndExcluding": "6.9.6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9", "versionEndExcluding": "6.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8.5"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/e8ccda39b395169622855607085cdeef4d376e0f"}, {"url": "https://git.kernel.org/stable/c/91cff53136daeff50816b0baeafd38a6976f6209"}, {"url": "https://git.kernel.org/stable/c/fa97b8fed9896f1e89cb657513e483a152d4c382"}, {"url": "https://git.kernel.org/stable/c/2884dc7d08d98a89d8d65121524bb7533183a63a"}], "title": "bpf: Fix a potential use-after-free in bpf_link_free()", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T04:39:55.487Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/91cff53136daeff50816b0baeafd38a6976f6209", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/fa97b8fed9896f1e89cb657513e483a152d4c382", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/2884dc7d08d98a89d8d65121524bb7533183a63a", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-40909", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T17:06:09.099919Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T17:34:37.410Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/91cff53136daeff50816b0baeafd38a6976f6209", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/fa97b8fed9896f1e89cb657513e483a152d4c382", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/2884dc7d08d98a89d8d65121524bb7533183a63a", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T04:39:55.487Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-40909", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T17:06:09.099919Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T12:42:24.857Z"}}], "cna": {"title": "bpf: Fix a potential use-after-free in bpf_link_free()", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerability is reached exclusively through the local `bpf()` syscall \u2014 creating a raw_tracepoint/kprobe_multi/uprobe_multi link and then closing its file descriptor. No network or remote-peer data is involved.\nAC:L - The attacker drives the free side directly and can repeat the create/close cycle in an unbounded loop across all CPUs while generating scheduling and RCU load to force preemption between `call_rcu()` and the stale `link->ops` read; syzbot triggered it in practice, so the window is reachable without relying on conditions outside attacker influence.\nPR:L - `bpf_token_capable()` grants BPF/PERFMON at `ns_capable()` level when a BPF token is delegated (kernel/bpf/token.c:17-28), so a process unprivileged in the init namespace inside a container can load these tracing programs and create the affected links; the same path is reachable by ordinary non-root service accounts holding only CAP_BPF+CAP_PERFMON, which is not administrative control of the host.\nUI:N - The entire sequence \u2014 link creation and fd close \u2014 is performed by the attacker's own process with no action required from any other user.\nS:U - The corruption and its consequences are confined to the kernel's own memory and privilege domain; no hypervisor, IOMMU, or other security-authority boundary is crossed.\nC:H - The use-after-free reads the `ops` pointer out of a freed slab object that the attacker can reallocate and fill via heap spraying, yielding an arbitrary kernel pointer dereference and an arbitrary-read primitive over kernel memory.\nI:H - After the stale `link->ops` read, the code performs `link->ops->dealloc(link)` \u2014 an indirect call through an attacker-controlled function pointer table, giving control-flow hijack and full kernel-integrity compromise.\nA:H - Even unweaponized, dereferencing and calling through a freed/recycled `ops` pointer produces a wild indirect branch and immediate kernel oops or panic, and the attacker can trigger it repeatedly."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "ac48dc6ac9240f73bf08d29edf65c2deca93ee5d", "lessThan": "e8ccda39b395169622855607085cdeef4d376e0f", "versionType": "git"}, {"status": "affected", "version": "876941f533e7b47fc69977fc4551c02f2d18af97", "lessThan": "91cff53136daeff50816b0baeafd38a6976f6209", "versionType": "git"}, {"status": "affected", "version": "1a80dbcb2dbaf6e4c216e62e30fa7d3daa8001ce", "lessThan": "fa97b8fed9896f1e89cb657513e483a152d4c382", "versionType": "git"}, {"status": "affected", "version": "1a80dbcb2dbaf6e4c216e62e30fa7d3daa8001ce", "lessThan": "2884dc7d08d98a89d8d65121524bb7533183a63a", "versionType": "git"}, {"status": "affected", "version": "5d8d447777564b35f67000e7838e7ccb64d525c8", "versionType": "git"}, {"status": "affected", "version": "6.6.26", "lessThan": "6.6.35", "versionType": "semver"}, {"status": "affected", "version": "6.8.5", "lessThan": "6.9", "versionType": "semver"}], "programFiles": ["kernel/bpf/syscall.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.9"}, {"status": "unaffected", "version": "0", "lessThan": "6.9", "versionType": "semver"}, {"status": "unaffected", "version": "6.6.35", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.9.6", "versionType": "semver", "lessThanOrEqual": "6.9.*"}, {"status": "unaffected", "version": "6.10", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["kernel/bpf/syscall.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/e8ccda39b395169622855607085cdeef4d376e0f"}, {"url": "https://git.kernel.org/stable/c/91cff53136daeff50816b0baeafd38a6976f6209"}, {"url": "https://git.kernel.org/stable/c/fa97b8fed9896f1e89cb657513e483a152d4c382"}, {"url": "https://git.kernel.org/stable/c/2884dc7d08d98a89d8d65121524bb7533183a63a"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix a potential use-after-free in bpf_link_free()\n\nAfter commit 1a80dbcb2dba, bpf_link can be freed by\nlink->ops->dealloc_deferred, but the code still tests and uses\nlink->ops->dealloc afterward, which leads to a use-after-free as\nreported by syzbot. Actually, one of them should be sufficient, so\njust call one of them instead of both. Also add a WARN_ON() in case\nof any problematic implementation."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.35", "versionStartIncluding": "6.6.26"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.9.6", "versionStartIncluding": "6.9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.10", "versionStartIncluding": "6.9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "6.8.5"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:18:36.759Z"}}}, "cveMetadata": {"cveId": "CVE-2024-40909", "state": "PUBLISHED", "dateUpdated": "2026-10-30T12:18:36.759Z", "dateReserved": "2024-07-12T12:17:45.580Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-07-12T12:20:48.447Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["kernel/bpf/syscall.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "e8ccda39b395169622855607085cdeef4d376e0f", "status": "affected", "version": "ac48dc6ac9240f73bf08d29edf65c2deca93ee5d", "versionType": "git"}, {"lessThan": "91cff53136daeff50816b0baeafd38a6976f6209", "status": "affected", "version": "876941f533e7b47fc69977fc4551c02f2d18af97", "versionType": "git"}, {"lessThan": "fa97b8fed9896f1e89cb657513e483a152d4c382", "status": "affected", "version": "1a80dbcb2dbaf6e4c216e62e30fa7d3daa8001ce", "versionType": "git"}, {"lessThan": "2884dc7d08d98a89d8d65121524bb7533183a63a", "status": "affected", "version": "1a80dbcb2dbaf6e4c216e62e30fa7d3daa8001ce", "versionType": "git"}, {"status": "affected", "version": "5d8d447777564b35f67000e7838e7ccb64d525c8", "versionType": "git"}, {"lessThan": "6.6.35", "status": "affected", "version": "6.6.26", "versionType": "semver"}, {"lessThan": "6.9", "status": "affected", "version": "6.8.5", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["kernel/bpf/syscall.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.9"}, {"lessThan": "6.9", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.35", "versionType": "semver"}, {"lessThanOrEqual": "6.9.*", "status": "unaffected", "version": "6.9.6", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.10", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "610CA734-4C6D-43D5-B254-80BB5B7E5098", "versionEndExcluding": "6.6.35", "versionStartIncluding": "6.6.26", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "A2E0E6CD-2DC0-4E5C-9037-9A023960B2F9", "versionEndExcluding": "6.9.6", "versionStartIncluding": "6.9", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.10:rc1:*:*:*:*:*:*", "matchCriteriaId": "2EBB4392-5FA6-4DA9-9772-8F9C750109FA", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.10:rc2:*:*:*:*:*:*", "matchCriteriaId": "331C2F14-12C7-45D5-893D-8C52EE38EA10", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix a potential use-after-free in bpf_link_free()\n\nAfter commit 1a80dbcb2dba, bpf_link can be freed by\nlink->ops->dealloc_deferred, but the code still tests and uses\nlink->ops->dealloc afterward, which leads to a use-after-free as\nreported by syzbot. Actually, one of them should be sufficient, so\njust call one of them instead of both. Also add a WARN_ON() in case\nof any problematic implementation."}, {"lang": "es", "value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: bpf: corrige un posible use-after-free en bpf_link_free() Despu\u00e9s del commit 1a80dbcb2dba, bpf_link se puede liberar mediante link->ops->dealloc_deferred, pero el c\u00f3digo a\u00fan prueba y usa link->ops->dealloc despu\u00e9s, lo que conduce a un use-after-free seg\u00fan lo informado por syzbot. En realidad, uno de ellos deber\u00eda ser suficiente, as\u00ed que llame a uno de ellos en lugar de a ambos. Tambi\u00e9n agregue WARN_ON() en caso de cualquier implementaci\u00f3n problem\u00e1tica."}], "id": "CVE-2024-40909", "lastModified": "2026-10-30T13:17:29.717", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-40909", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-09-10T17:06:09.099919Z", "version": "2.0.3"}}]}, "published": "2024-07-12T13:15:14.137", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/2884dc7d08d98a89d8d65121524bb7533183a63a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/91cff53136daeff50816b0baeafd38a6976f6209"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e8ccda39b395169622855607085cdeef4d376e0f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/fa97b8fed9896f1e89cb657513e483a152d4c382"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/2884dc7d08d98a89d8d65121524bb7533183a63a"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/91cff53136daeff50816b0baeafd38a6976f6209"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/fa97b8fed9896f1e89cb657513e483a152d4c382"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: bpf: Fix a potential use-after-free in bpf_link_free()", "id": "2297493", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2297493"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.8", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-416", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nbpf: Fix a potential use-after-free in bpf_link_free()\nAfter commit 1a80dbcb2dba, bpf_link can be freed by\nlink->ops->dealloc_deferred, but the code still tests and uses\nlink->ops->dealloc afterward, which leads to a use-after-free as\nreported by syzbot. Actually, one of them should be sufficient, so\njust call one of them instead of both. Also add a WARN_ON() in case\nof any problematic implementation."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2024-40909", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-07-12T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-40909\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-40909\nhttps://lore.kernel.org/linux-cve-announce/2024071210-CVE-2024-40909-1706@gregkh/T"], "statement": "Red Hat Enterprise Linux is not vulnerable to this CVE, as it does not affect the versions or configurations of the Linux kernel used in its distributions.", "threat_severity": "Moderate"}

{}