CVE-2024-40991

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-40991", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-07-12T12:17:45.605Z", "datePublished": "2024-07-12T12:37:35.138Z", "dateUpdated": "2026-08-05T11:34:29.218Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:34:29.218Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: ti: k3-udma-glue: Fix of_k3_udma_glue_parse_chn_by_id()\n\nThe of_k3_udma_glue_parse_chn_by_id() helper function erroneously\ninvokes \"of_node_put()\" on the \"udmax_np\" device-node passed to it,\nwithout having incremented its reference count at any point. Fix it."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable helper is only reachable from the k3-udma-glue channel-request API invoked during driver probe on TI K3 SoCs; there is no network, packet-receive, or remote-peer data path to it. Repetition requires local actions such as driver bind/unbind or module reload, so local access is the applicable vector.\nAC:L - The unbalanced of_node_put() executes unconditionally on every call path, success and failure alike, with no race to win and no memory-layout precondition the attacker cannot influence. Each invocation \u2014 including every deferred-probe retry \u2014 deterministically drops one reference.\nPR:L - No capability check, credential test, or access-control gate exists anywhere between the entry point and the underflow, and the reference is dropped automatically during boot-time probe without any privileged action being needed to create the condition. Choosing the higher-severity reading, a basic local user rather than real root is treated as sufficient.\nUI:N - The refcount underflow happens inside the driver's own probe/channel-request flow with no victim action required \u2014 no filesystem mount, file open, or device attach by another user is part of the trigger.\nS:U - The corrupted object is a kernel OF device_node, and all consequences \u2014 the erroneous release, the refcount saturation warning, and any subsequent use-after-free \u2014 remain within the kernel's own security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - The immediate of_node_release() failure path dumps a kernel stack trace exposing addresses and symbols, and on DT-overlay-based K3 platforms the premature refcount-zero permits the node to be freed while still referenced, yielding a use-after-free read primitive over device_node contents. Per use-after-free guidance this is High.\nI:H - A device_node freed while other subsystems retain pointers is a classic heap-spray target whose properties, full_name, and data pointers are written through, converting the underflow into an arbitrary-write and control-flow-hijack primitive. Use-after-free is scored High for integrity.\nA:H - The underflow reaches refcount_warn_saturate() with the \"refcount_t: underflow; use-after-free\" splat, which is a fatal panic under panic_on_warn or CONFIG_BUG_ON_DATA_CORRUPTION, and the resulting use-after-free causes kernel oopses even when not weaponized."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/dma/ti/k3-udma-glue.c"], "versions": [{"version": "81a1f90f20af71728f900f245aa69e9425fdef84", "lessThan": "a5ab5f413d1e4c7ed5f64271b025f0726374509e", "status": "affected", "versionType": "git"}, {"version": "81a1f90f20af71728f900f245aa69e9425fdef84", "lessThan": "ba27e9d2207784da748b19170a2e56bd7770bd81", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/dma/ti/k3-udma-glue.c"], "versions": [{"version": "6.9", "status": "affected"}, {"version": "0", "lessThan": "6.9", "status": "unaffected", "versionType": "semver"}, {"version": "6.9.7", "lessThanOrEqual": "6.9.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.10", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9", "versionEndExcluding": "6.9.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9", "versionEndExcluding": "6.10"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/a5ab5f413d1e4c7ed5f64271b025f0726374509e"}, {"url": "https://git.kernel.org/stable/c/ba27e9d2207784da748b19170a2e56bd7770bd81"}], "title": "dmaengine: ti: k3-udma-glue: Fix of_k3_udma_glue_parse_chn_by_id()", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T04:39:56.059Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/a5ab5f413d1e4c7ed5f64271b025f0726374509e", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/ba27e9d2207784da748b19170a2e56bd7770bd81", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-40991", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T17:01:48.045329Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T17:34:20.263Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/a5ab5f413d1e4c7ed5f64271b025f0726374509e", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/ba27e9d2207784da748b19170a2e56bd7770bd81", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T04:39:56.059Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-40991", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T17:01:48.045329Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T12:42:22.072Z"}}], "cna": {"title": "dmaengine: ti: k3-udma-glue: Fix of_k3_udma_glue_parse_chn_by_id()", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "81a1f90f20af71728f900f245aa69e9425fdef84", "lessThan": "a5ab5f413d1e4c7ed5f64271b025f0726374509e", "versionType": "git"}, {"status": "affected", "version": "81a1f90f20af71728f900f245aa69e9425fdef84", "lessThan": "ba27e9d2207784da748b19170a2e56bd7770bd81", "versionType": "git"}], "programFiles": ["drivers/dma/ti/k3-udma-glue.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.9"}, {"status": "unaffected", "version": "0", "lessThan": "6.9", "versionType": "semver"}, {"status": "unaffected", "version": "6.9.7", "versionType": "semver", "lessThanOrEqual": "6.9.*"}, {"status": "unaffected", "version": "6.10", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/dma/ti/k3-udma-glue.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/a5ab5f413d1e4c7ed5f64271b025f0726374509e"}, {"url": "https://git.kernel.org/stable/c/ba27e9d2207784da748b19170a2e56bd7770bd81"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: ti: k3-udma-glue: Fix of_k3_udma_glue_parse_chn_by_id()\n\nThe of_k3_udma_glue_parse_chn_by_id() helper function erroneously\ninvokes \"of_node_put()\" on the \"udmax_np\" device-node passed to it,\nwithout having incremented its reference count at any point. Fix it."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.9.7", "versionStartIncluding": "6.9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.10", "versionStartIncluding": "6.9"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2025-05-04T09:19:30.933Z"}}}, "cveMetadata": {"cveId": "CVE-2024-40991", "state": "PUBLISHED", "dateUpdated": "2025-05-04T09:19:30.933Z", "dateReserved": "2024-07-12T12:17:45.605Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-07-12T12:37:35.138Z", "assignerShortName": "Linux"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/dma/ti/k3-udma-glue.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "a5ab5f413d1e4c7ed5f64271b025f0726374509e", "status": "affected", "version": "81a1f90f20af71728f900f245aa69e9425fdef84", "versionType": "git"}, {"lessThan": "ba27e9d2207784da748b19170a2e56bd7770bd81", "status": "affected", "version": "81a1f90f20af71728f900f245aa69e9425fdef84", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/dma/ti/k3-udma-glue.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.9"}, {"lessThan": "6.9", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.9.*", "status": "unaffected", "version": "6.9.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.10", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "1833E4E3-20C1-46FE-BE78-1FA23B2452C0", "versionEndExcluding": "6.9.7", "versionStartIncluding": "6.9", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.10:rc1:*:*:*:*:*:*", "matchCriteriaId": "2EBB4392-5FA6-4DA9-9772-8F9C750109FA", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.10:rc2:*:*:*:*:*:*", "matchCriteriaId": "331C2F14-12C7-45D5-893D-8C52EE38EA10", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.10:rc3:*:*:*:*:*:*", "matchCriteriaId": "3173713D-909A-4DD3-9DD4-1E171EB057EE", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.10:rc4:*:*:*:*:*:*", "matchCriteriaId": "79F18AFA-40F7-43F0-BA30-7BDB65F918B9", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: ti: k3-udma-glue: Fix of_k3_udma_glue_parse_chn_by_id()\n\nThe of_k3_udma_glue_parse_chn_by_id() helper function erroneously\ninvokes \"of_node_put()\" on the \"udmax_np\" device-node passed to it,\nwithout having incremented its reference count at any point. Fix it."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: dmaengine: ti: k3-udma-glue: Fix of_k3_udma_glue_parse_chn_by_id() La funci\u00f3n auxiliar of_k3_udma_glue_parse_chn_by_id() invoca err\u00f3neamente \"of_node_put()\" en el nodo de dispositivo \"udmax_np\" que se le pas\u00f3 , sin haber incrementado su recuento de referencias en ning\u00fan momento. Arreglalo."}], "id": "CVE-2024-40991", "lastModified": "2026-08-04T11:19:13.817", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-40991", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-09-10T17:01:48.045329Z", "version": "2.0.3"}}]}, "published": "2024-07-12T13:15:20.430", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a5ab5f413d1e4c7ed5f64271b025f0726374509e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ba27e9d2207784da748b19170a2e56bd7770bd81"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a5ab5f413d1e4c7ed5f64271b025f0726374509e"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ba27e9d2207784da748b19170a2e56bd7770bd81"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: dmaengine: ti: k3-udma-glue: Fix of_k3_udma_glue_parse_chn_by_id()", "id": "2297575", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2297575"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.4", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-911", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ndmaengine: ti: k3-udma-glue: Fix of_k3_udma_glue_parse_chn_by_id()\nThe of_k3_udma_glue_parse_chn_by_id() helper function erroneously\ninvokes \"of_node_put()\" on the \"udmax_np\" device-node passed to it,\nwithout having incremented its reference count at any point. Fix it.", "A vulnerability was found in the Linux kernel's DMA engine component due to an issue in the `of_k3_udma_glue_parse_chn_by_id()` helper function. It incorrectly invoked the `of_node_put()` function on the `udmax_np` device-node without first incrementing its reference count, which could lead to potential issues in resource management."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2024-40991", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-07-12T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-40991\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-40991\nhttps://lore.kernel.org/linux-cve-announce/2024071250-CVE-2024-40991-34b6@gregkh/T"], "statement": "Red Hat Enterprise Linux is not vulnerable to this CVE, as it does not affect the versions or configurations of the Linux kernel used in its distributions.", "threat_severity": "Moderate"}

{"created": "2025-07-12T22:23:22.870670+00:00", "updated": "2025-07-12T22:23:22.870737+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}