CVE-2024-40986

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-40986", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-07-12T12:17:45.605Z", "datePublished": "2024-07-12T12:37:31.800Z", "dateUpdated": "2026-08-05T11:34:26.008Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:34:26.008Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: xilinx: xdma: Fix data synchronisation in xdma_channel_isr()\n\nRequests the vchan lock before using xdma->stop_request."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The race is driven through local client interfaces of the XDMA dmaengine provider \u2014 ALSA PCM trigger-stop/hw_free and V4L2 stop/DMA-timeout paths on /dev/snd/pcmC* and /dev/video* \u2014 which require local access to the system. There is no remote or network-facing path into drivers/dma/xilinx/xdma.c.\nAC:L - The attacker controls the terminate side of the race (issuing stream stop/STREAMOFF or PCM stop whenever it chooses) and can influence the interrupt side by selecting transfer/period sizes, and the attempt can be repeated indefinitely at no cost until the unlocked stop_requested read is mistimed.\nPR:L - Only an unprivileged local account with ordinary access to the audio or video device node backed by the XDMA channels is needed \u2014 no capabilities or root, since dmaengine_terminate_*/dmaengine_synchronize are invoked on behalf of normal PCM/V4L2 operations.\nUI:N - The attacker triggers the start/stop transfer cycle entirely on its own; no action by another user or administrator is required.\nS:U - The corruption occurs in kernel memory (dma_pool descriptor blocks and client DMA buffers) managed by the same kernel security authority; no VM, sandbox, or IOMMU boundary is crossed.\nC:H - Losing the last-interrupt synchronization lets descriptor blocks and data buffers be freed and reused while the PCIe engine is still reading them, so card-to-host and host-to-card transfers can expose recycled kernel memory contents to the device and to subsequent users of those pages.\nI:H - The DMA engine can continue writing into freed/recycled dma_pool memory and follow stale or attacker-groomed descriptor contents, giving a memory-corruption write primitive against arbitrary kernel-mapped memory that is a classic path to control-flow hijack.\nA:H - The same use-after-free of live descriptor blocks reliably produces kernel memory corruption and oops/panic, and the missed completion also stalls xdma_synchronize() on its one-second timeout on every terminate."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/dma/xilinx/xdma.c"], "versions": [{"version": "6a40fb8245965b481b4dcce011cd63f20bf91ee0", "lessThan": "8e1f54e4a3f3207c9dc68bb5000603b75802e7f0", "status": "affected", "versionType": "git"}, {"version": "6a40fb8245965b481b4dcce011cd63f20bf91ee0", "lessThan": "462237d2d93fc9e9221d1cf9f773954d27da83c0", "status": "affected", "versionType": "git"}, {"version": "582ce5d734190d74e5ce9cd711cf6e964e1e7b29", "status": "affected", "versionType": "git"}, {"version": "6.8.9", "lessThan": "6.9", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/dma/xilinx/xdma.c"], "versions": [{"version": "6.9", "status": "affected"}, {"version": "0", "lessThan": "6.9", "status": "unaffected", "versionType": "semver"}, {"version": "6.9.7", "lessThanOrEqual": "6.9.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.10", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9", "versionEndExcluding": "6.9.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9", "versionEndExcluding": "6.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8.9"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/8e1f54e4a3f3207c9dc68bb5000603b75802e7f0"}, {"url": "https://git.kernel.org/stable/c/462237d2d93fc9e9221d1cf9f773954d27da83c0"}], "title": "dmaengine: xilinx: xdma: Fix data synchronisation in xdma_channel_isr()", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T04:39:55.848Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/8e1f54e4a3f3207c9dc68bb5000603b75802e7f0", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/462237d2d93fc9e9221d1cf9f773954d27da83c0", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-40986", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T17:02:03.948638Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T17:34:20.818Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/8e1f54e4a3f3207c9dc68bb5000603b75802e7f0", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/462237d2d93fc9e9221d1cf9f773954d27da83c0", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T04:39:55.848Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-40986", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T17:02:03.948638Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T12:42:22.125Z"}}], "cna": {"title": "dmaengine: xilinx: xdma: Fix data synchronisation in xdma_channel_isr()", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6a40fb8245965b481b4dcce011cd63f20bf91ee0", "lessThan": "8e1f54e4a3f3207c9dc68bb5000603b75802e7f0", "versionType": "git"}, {"status": "affected", "version": "6a40fb8245965b481b4dcce011cd63f20bf91ee0", "lessThan": "462237d2d93fc9e9221d1cf9f773954d27da83c0", "versionType": "git"}, {"status": "affected", "version": "582ce5d734190d74e5ce9cd711cf6e964e1e7b29", "versionType": "git"}, {"status": "affected", "version": "6.8.9", "lessThan": "6.9", "versionType": "semver"}], "programFiles": ["drivers/dma/xilinx/xdma.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.9"}, {"status": "unaffected", "version": "0", "lessThan": "6.9", "versionType": "semver"}, {"status": "unaffected", "version": "6.9.7", "versionType": "semver", "lessThanOrEqual": "6.9.*"}, {"status": "unaffected", "version": "6.10", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/dma/xilinx/xdma.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/8e1f54e4a3f3207c9dc68bb5000603b75802e7f0"}, {"url": "https://git.kernel.org/stable/c/462237d2d93fc9e9221d1cf9f773954d27da83c0"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: xilinx: xdma: Fix data synchronisation in xdma_channel_isr()\n\nRequests the vchan lock before using xdma->stop_request."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.9.7", "versionStartIncluding": "6.9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.10", "versionStartIncluding": "6.9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "6.8.9"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-23T15:51:18.929Z"}}}, "cveMetadata": {"cveId": "CVE-2024-40986", "state": "PUBLISHED", "dateUpdated": "2026-05-23T15:51:18.929Z", "dateReserved": "2024-07-12T12:17:45.605Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-07-12T12:37:31.800Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/dma/xilinx/xdma.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "8e1f54e4a3f3207c9dc68bb5000603b75802e7f0", "status": "affected", "version": "6a40fb8245965b481b4dcce011cd63f20bf91ee0", "versionType": "git"}, {"lessThan": "462237d2d93fc9e9221d1cf9f773954d27da83c0", "status": "affected", "version": "6a40fb8245965b481b4dcce011cd63f20bf91ee0", "versionType": "git"}, {"status": "affected", "version": "582ce5d734190d74e5ce9cd711cf6e964e1e7b29", "versionType": "git"}, {"lessThan": "6.9", "status": "affected", "version": "6.8.9", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/dma/xilinx/xdma.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.9"}, {"lessThan": "6.9", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.9.*", "status": "unaffected", "version": "6.9.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.10", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "FA65DB5F-1903-4FD5-AB56-6A58A5DB2D15", "versionEndExcluding": "6.9", "versionStartIncluding": "6.8.9", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "5BF482BC-6498-4F25-A571-A61564BDC40B", "versionEndExcluding": "6.9.7", "versionStartIncluding": "6.9.1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.9:-:*:*:*:*:*:*", "matchCriteriaId": "3F2A4A3D-068A-4CF2-A09F-9C7937DDB0A5", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc6:*:*:*:*:*:*", "matchCriteriaId": "91326417-E981-482E-A5A3-28BC1327521B", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc7:*:*:*:*:*:*", "matchCriteriaId": "DAECDCD8-F556-4606-8D7B-5C6D47A501F2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.10:rc1:*:*:*:*:*:*", "matchCriteriaId": "2EBB4392-5FA6-4DA9-9772-8F9C750109FA", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.10:rc2:*:*:*:*:*:*", "matchCriteriaId": "331C2F14-12C7-45D5-893D-8C52EE38EA10", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.10:rc3:*:*:*:*:*:*", "matchCriteriaId": "3173713D-909A-4DD3-9DD4-1E171EB057EE", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.10:rc4:*:*:*:*:*:*", "matchCriteriaId": "79F18AFA-40F7-43F0-BA30-7BDB65F918B9", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: xilinx: xdma: Fix data synchronisation in xdma_channel_isr()\n\nRequests the vchan lock before using xdma->stop_request."}, {"lang": "es", "value": "En el kernel de Linux se ha resuelto la siguiente vulnerabilidad: dmaengine: xilinx: xdma: corrige la sincronizaci\u00f3n de datos en xdma_channel_isr() Solicita el bloqueo de vchan antes de usar xdma->stop_request."}], "id": "CVE-2024-40986", "lastModified": "2026-08-04T11:19:12.940", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-40986", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-09-10T17:02:03.948638Z", "version": "2.0.3"}}]}, "published": "2024-07-12T13:15:20.113", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/462237d2d93fc9e9221d1cf9f773954d27da83c0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/8e1f54e4a3f3207c9dc68bb5000603b75802e7f0"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/462237d2d93fc9e9221d1cf9f773954d27da83c0"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/8e1f54e4a3f3207c9dc68bb5000603b75802e7f0"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: dmaengine: xilinx: xdma: Fix data synchronisation in xdma_channel_isr()", "id": "2297570", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2297570"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.1", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H", "status": "draft"}, "cwe": "CWE-820", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ndmaengine: xilinx: xdma: Fix data synchronisation in xdma_channel_isr()\nRequests the vchan lock before using xdma->stop_request.", "A vulnerability was found in dmaengine in the Linux kernel. This issue was resolved by fixing data synchronization in the `xdma_channel_isr()` function. The update ensures the vchan lock is acquired before accessing `xdma->stop_request`, preventing race conditions during interrupt handling in XDMA channels."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2024-40986", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-07-12T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-40986\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-40986\nhttps://lore.kernel.org/linux-cve-announce/2024071248-CVE-2024-40986-f31c@gregkh/T"], "statement": "Red Hat Enterprise Linux is not vulnerable to this CVE, as it does not affect the versions or configurations of the Linux kernel used in its distributions.", "threat_severity": "Moderate"}

{"created": "2025-07-12T22:44:39.592252+00:00", "updated": "2025-07-12T22:44:39.592315+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}