CVE-2024-40920

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-40920", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-07-12T12:17:45.582Z", "datePublished": "2024-07-12T12:25:02.222Z", "dateUpdated": "2026-08-05T11:34:00.976Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:34:00.976Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bridge: mst: fix suspicious rcu usage in br_mst_set_state\n\nI converted br_mst_set_state to RCU to avoid a vlan use-after-free\nbut forgot to change the vlan group dereference helper. Switch to vlan\ngroup RCU deref helper to fix the suspicious rcu usage warning."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "baseScore": 7.1, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:A - The buggy dereference is reached from the STP BPDU receive path (`br_stp_rcv` \u2192 `br_port_state_selection` \u2192 `br_set_state` \u2192 `br_mst_set_state`), so an attacker on the same L2 segment can drive port state transitions into it; STP BPDUs use the link-local `01:80:C2:00:00:00` LLC group address and are not routable, so this is adjacent rather than network.\nAC:L - On an MST-enabled bridge running kernel STP the unannotated dereference is hit deterministically on every port state transition, and the attacker drives both sides \u2014 flapping BPDUs force repeated transitions while port add/remove concurrently republishes `p->vlgrp` \u2014 with no timing window or memory layout that must be won.\nPR:N - STP BPDU processing in `br_stp_rcv()` has no authentication whatsoever \u2014 a frame from the segment is accepted on any non-disabled, non-BPDU-guarded port \u2014 so the adjacent attacker needs no credentials on the target host.\nUI:N - Port state transitions occur automatically from received BPDUs and from the forward-delay timer; no administrator or user action is needed once the bridge is in MST mode.\nS:U - The faulty dereference, the resulting fault, and the log disclosure are all confined to the kernel that owns the bridge; no VM, IOMMU, or sandbox boundary is crossed.\nC:L - The `lockdep_rcu_suspicious()` report dumps a full kernel backtrace with raw stack and register addresses (as seen in the syzbot trace) into the kernel log, disclosing text and stack layout useful for defeating KASLR; there is no bulk or arbitrary memory read.\nI:N - The defect is a read-side annotation mismatch \u2014 no attacker-controlled data is written and no out-of-bounds or freed memory is modified, so no write or control-flow-hijack primitive results.\nA:H - Without the RCU dereference the load of `p->vlgrp` carries no `READ_ONCE()` or dependency ordering, so a softirq reader racing a concurrent `nbp_vlan_flush()`/`nbp_vlan_init()` can traverse `vg->vlan_list` and write `vg->pvid_state` on a NULL or not-yet-published group, oopsing the kernel and taking down the bridging host."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/bridge/br_mst.c"], "versions": [{"version": "8ca9a750fc711911ef616ceb627d07357b04545e", "lessThan": "caaa2129784a04dcade0ea92c12e6ff90bbd23d8", "status": "affected", "versionType": "git"}, {"version": "4488617e5e995a09abe4d81add5fb165674edb59", "lessThan": "7caefa2771722e65496d85b62e1dc4442b7d1345", "status": "affected", "versionType": "git"}, {"version": "e43dd2b1ec746e105b7db5f9ad6ef14685a615a4", "lessThan": "406bfc04b01ee47e4c626f77ecc7d9f85135b166", "status": "affected", "versionType": "git"}, {"version": "3a7c1661ae1383364cd6092d851f5e5da64d476b", "lessThan": "546ceb1dfdac866648ec959cbc71d9525bd73462", "status": "affected", "versionType": "git"}, {"version": "a2b01e65d9ba8af2bb086d3b7288ca53a07249ac", "status": "affected", "versionType": "git"}, {"version": "6.8.12", "lessThan": "6.9", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/bridge/br_mst.c"], "versions": [{"version": "6.1.93", "lessThan": "6.1.95", "status": "affected", "versionType": "semver"}, {"version": "6.6.33", "lessThan": "6.6.35", "status": "affected", "versionType": "semver"}, {"version": "6.9.3", "lessThan": "6.9.6", "status": "affected", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1.93", "versionEndExcluding": "6.1.95"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6.33", "versionEndExcluding": "6.6.35"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9.3", "versionEndExcluding": "6.9.6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8.12"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/caaa2129784a04dcade0ea92c12e6ff90bbd23d8"}, {"url": "https://git.kernel.org/stable/c/7caefa2771722e65496d85b62e1dc4442b7d1345"}, {"url": "https://git.kernel.org/stable/c/406bfc04b01ee47e4c626f77ecc7d9f85135b166"}, {"url": "https://git.kernel.org/stable/c/546ceb1dfdac866648ec959cbc71d9525bd73462"}], "title": "net: bridge: mst: fix suspicious rcu usage in br_mst_set_state", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/caaa2129784a04dcade0ea92c12e6ff90bbd23d8", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/7caefa2771722e65496d85b62e1dc4442b7d1345", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/406bfc04b01ee47e4c626f77ecc7d9f85135b166", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/546ceb1dfdac866648ec959cbc71d9525bd73462", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T21:57:50.802Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-40920", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T17:05:33.673278Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T17:33:03.619Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/caaa2129784a04dcade0ea92c12e6ff90bbd23d8", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/7caefa2771722e65496d85b62e1dc4442b7d1345", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/406bfc04b01ee47e4c626f77ecc7d9f85135b166", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/546ceb1dfdac866648ec959cbc71d9525bd73462", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T21:57:50.802Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-40920", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T17:05:33.673278Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T12:42:14.304Z"}}], "cna": {"title": "net: bridge: mst: fix suspicious rcu usage in br_mst_set_state", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "8ca9a750fc711911ef616ceb627d07357b04545e", "lessThan": "caaa2129784a04dcade0ea92c12e6ff90bbd23d8", "versionType": "git"}, {"status": "affected", "version": "4488617e5e995a09abe4d81add5fb165674edb59", "lessThan": "7caefa2771722e65496d85b62e1dc4442b7d1345", "versionType": "git"}, {"status": "affected", "version": "e43dd2b1ec746e105b7db5f9ad6ef14685a615a4", "lessThan": "406bfc04b01ee47e4c626f77ecc7d9f85135b166", "versionType": "git"}, {"status": "affected", "version": "3a7c1661ae1383364cd6092d851f5e5da64d476b", "lessThan": "546ceb1dfdac866648ec959cbc71d9525bd73462", "versionType": "git"}, {"status": "affected", "version": "a2b01e65d9ba8af2bb086d3b7288ca53a07249ac", "versionType": "git"}, {"status": "affected", "version": "6.8.12", "lessThan": "6.9", "versionType": "semver"}], "programFiles": ["net/bridge/br_mst.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.1.93", "lessThan": "6.1.95", "versionType": "semver"}, {"status": "affected", "version": "6.6.33", "lessThan": "6.6.35", "versionType": "semver"}, {"status": "affected", "version": "6.9.3", "lessThan": "6.9.6", "versionType": "semver"}], "programFiles": ["net/bridge/br_mst.c"], "defaultStatus": "unaffected"}], "references": [{"url": "https://git.kernel.org/stable/c/caaa2129784a04dcade0ea92c12e6ff90bbd23d8"}, {"url": "https://git.kernel.org/stable/c/7caefa2771722e65496d85b62e1dc4442b7d1345"}, {"url": "https://git.kernel.org/stable/c/406bfc04b01ee47e4c626f77ecc7d9f85135b166"}, {"url": "https://git.kernel.org/stable/c/546ceb1dfdac866648ec959cbc71d9525bd73462"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bridge: mst: fix suspicious rcu usage in br_mst_set_state\n\nI converted br_mst_set_state to RCU to avoid a vlan use-after-free\nbut forgot to change the vlan group dereference helper. Switch to vlan\ngroup RCU deref helper to fix the suspicious rcu usage warning."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.95", "versionStartIncluding": "6.1.93"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.35", "versionStartIncluding": "6.6.33"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.9.6", "versionStartIncluding": "6.9.3"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "6.8.12"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-23T15:51:02.195Z"}}}, "cveMetadata": {"cveId": "CVE-2024-40920", "state": "PUBLISHED", "dateUpdated": "2026-05-23T15:51:02.195Z", "dateReserved": "2024-07-12T12:17:45.582Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-07-12T12:25:02.222Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/bridge/br_mst.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "caaa2129784a04dcade0ea92c12e6ff90bbd23d8", "status": "affected", "version": "8ca9a750fc711911ef616ceb627d07357b04545e", "versionType": "git"}, {"lessThan": "7caefa2771722e65496d85b62e1dc4442b7d1345", "status": "affected", "version": "4488617e5e995a09abe4d81add5fb165674edb59", "versionType": "git"}, {"lessThan": "406bfc04b01ee47e4c626f77ecc7d9f85135b166", "status": "affected", "version": "e43dd2b1ec746e105b7db5f9ad6ef14685a615a4", "versionType": "git"}, {"lessThan": "546ceb1dfdac866648ec959cbc71d9525bd73462", "status": "affected", "version": "3a7c1661ae1383364cd6092d851f5e5da64d476b", "versionType": "git"}, {"status": "affected", "version": "a2b01e65d9ba8af2bb086d3b7288ca53a07249ac", "versionType": "git"}, {"lessThan": "6.9", "status": "affected", "version": "6.8.12", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/bridge/br_mst.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "6.1.95", "status": "affected", "version": "6.1.93", "versionType": "semver"}, {"lessThan": "6.6.35", "status": "affected", "version": "6.6.33", "versionType": "semver"}, {"lessThan": "6.9.6", "status": "affected", "version": "6.9.3", "versionType": "semver"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "12D7386D-25E8-40A5-B960-F1289E3EB949", "versionEndExcluding": "6.1.95", "versionStartIncluding": "6.1.93", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "AB52DAFF-C60A-4A6B-AF37-0991CBCE7C93", "versionEndExcluding": "6.6.35", "versionStartIncluding": "6.6.33", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "A2D25EF8-8B93-4187-9555-F83C6F1ECA47", "versionEndExcluding": "6.9", "versionStartIncluding": "6.8.12", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "B88D7AAA-B04F-4917-8190-1583726FE2B2", "versionEndExcluding": "6.9.6", "versionStartIncluding": "6.9.3", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.10:rc1:*:*:*:*:*:*", "matchCriteriaId": "2EBB4392-5FA6-4DA9-9772-8F9C750109FA", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.10:rc2:*:*:*:*:*:*", "matchCriteriaId": "331C2F14-12C7-45D5-893D-8C52EE38EA10", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.10:rc3:*:*:*:*:*:*", "matchCriteriaId": "3173713D-909A-4DD3-9DD4-1E171EB057EE", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bridge: mst: fix suspicious rcu usage in br_mst_set_state\n\nI converted br_mst_set_state to RCU to avoid a vlan use-after-free\nbut forgot to change the vlan group dereference helper. Switch to vlan\ngroup RCU deref helper to fix the suspicious rcu usage warning."}, {"lang": "es", "value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: net: bridge: mst: corrige el uso sospechoso de rcu en br_mst_set_state Convert\u00ed br_mst_set_state a RCU para evitar un use-after-free de VLAN, pero olvid\u00e9 cambiar el asistente de desreferencia del grupo VLAN. Cambie al asistente deref de RCU del grupo vlan para corregir la advertencia de uso sospechoso de rcu."}], "id": "CVE-2024-40920", "lastModified": "2026-08-04T11:19:05.353", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 4.2, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-40920", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-09-10T17:05:33.673278Z", "version": "2.0.3"}}]}, "published": "2024-07-12T13:15:15.003", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/406bfc04b01ee47e4c626f77ecc7d9f85135b166"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/546ceb1dfdac866648ec959cbc71d9525bd73462"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/7caefa2771722e65496d85b62e1dc4442b7d1345"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/caaa2129784a04dcade0ea92c12e6ff90bbd23d8"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/406bfc04b01ee47e4c626f77ecc7d9f85135b166"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/546ceb1dfdac866648ec959cbc71d9525bd73462"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/7caefa2771722e65496d85b62e1dc4442b7d1345"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/caaa2129784a04dcade0ea92c12e6ff90bbd23d8"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: net: bridge: mst: fix suspicious rcu usage in br_mst_set_state", "id": "2297504", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2297504"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-416", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnet: bridge: mst: fix suspicious rcu usage in br_mst_set_state\nI converted br_mst_set_state to RCU to avoid a vlan use-after-free\nbut forgot to change the vlan group dereference helper. Switch to vlan\ngroup RCU deref helper to fix the suspicious rcu usage warning.", "A vulnerability was found in the Linux kernel's bridge subsystem, related to Multiple Spanning Tree (MST). The `br_mst_set_state` function was converted to use RCU to prevent a VLAN use-after-free, but fails to update the VLAN group dereference helper. This leads to warnings about improper RCU usage."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2024-40920", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-07-12T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-40920\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-40920\nhttps://lore.kernel.org/linux-cve-announce/2024071212-CVE-2024-40920-c766@gregkh/T"], "statement": "Red Hat Enterprise Linux is not vulnerable to this CVE, as it does not affect the versions or configurations of the Linux kernel used in its distributions.", "threat_severity": "Moderate"}

{"created": "2025-07-13T11:23:05.661473+00:00", "updated": "2025-07-13T11:23:05.661526+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}