CVE-2024-40992

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-40992", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-07-12T12:17:45.605Z", "datePublished": "2024-07-12T12:37:35.800Z", "dateUpdated": "2026-08-05T11:34:30.286Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:34:30.286Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rxe: Fix responder length checking for UD request packets\n\nAccording to the IBA specification:\nIf a UD request packet is detected with an invalid length, the request\nshall be an invalid request and it shall be silently dropped by\nthe responder. The responder then waits for a new request packet.\n\ncommit 689c5421bfe0 (\"RDMA/rxe: Fix incorrect responder length checking\")\ndefers responder length check for UD QPs in function `copy_data`.\nBut it introduces a regression issue for UD QPs.\n\nWhen the packet size is too large to fit in the receive buffer.\n`copy_data` will return error code -EINVAL. Then `send_data_in`\nwill return RESPST_ERR_MALFORMED_WQE. UD QP will transfer into\nERROR state."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:N - The rxe driver processes RoCEv2 packets received on UDP port 4791 from arbitrary remote peers over routed IP networks, and the malformed UD request is handled directly in the responder receive path. No adjacency or local access is required.\nAC:L - A single crafted UD SEND packet whose payload exceeds the receiver's posted receive buffer deterministically triggers the wrong error class and the QP error transition; there is no race, no memory-layout dependency, and the GSI Q_Key is a hardcoded well-known constant.\nPR:N - RoCE provides no authentication, check_addr() performs no source validation for UD/GSI QPs, the default full P_Key always matches, and QPN 1 uses the fixed GSI_QKEY value \u2014 so a completely unauthenticated off-system attacker can reach the vulnerable code.\nUI:N - The vulnerability is triggered entirely by an inbound packet processed asynchronously by the responder task; no action by any local user or application is needed.\nS:U - The impact is confined to the kernel's RDMA subsystem on the target host, within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:N - copy_data() still bounds the transfer against dma.resid, so no out-of-bounds read occurs and no memory contents are disclosed; the defect is only the error code returned on an already-detected overlong payload.\nI:N - There is no memory corruption or out-of-bounds write \u2014 the receive-buffer copy remains bounded and the failure is reported to the application via an error completion, so no data is silently modified.\nA:H - A single unauthenticated packet permanently forces the UD/GSI queue pair into IB_QPS_ERR via rxe_qp_error(), flushing all work requests and rendering the QP unusable until the application tears it down and recreates it; killing QP1 disables the MAD agent and thus RDMA-CM connection establishment for the entire device, and one multicast packet can destroy every QP in a group."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/infiniband/sw/rxe/rxe_resp.c"], "versions": [{"version": "689c5421bfe0eac65526bd97a466b9590a6aad3c", "lessThan": "163868ec1f6c610d16da9e458fe1dd7d5de97341", "status": "affected", "versionType": "git"}, {"version": "689c5421bfe0eac65526bd97a466b9590a6aad3c", "lessThan": "943c94f41dfe36536dc9aaa12c9efdf548ceb996", "status": "affected", "versionType": "git"}, {"version": "689c5421bfe0eac65526bd97a466b9590a6aad3c", "lessThan": "f67ac0061c7614c1548963d3ef1ee1606efd8636", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/infiniband/sw/rxe/rxe_resp.c"], "versions": [{"version": "6.2", "status": "affected"}, {"version": "0", "lessThan": "6.2", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.36", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.9.7", "lessThanOrEqual": "6.9.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.10", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "6.6.36"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "6.9.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "6.10"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/163868ec1f6c610d16da9e458fe1dd7d5de97341"}, {"url": "https://git.kernel.org/stable/c/943c94f41dfe36536dc9aaa12c9efdf548ceb996"}, {"url": "https://git.kernel.org/stable/c/f67ac0061c7614c1548963d3ef1ee1606efd8636"}], "title": "RDMA/rxe: Fix responder length checking for UD request packets", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T04:39:56.166Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/163868ec1f6c610d16da9e458fe1dd7d5de97341", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/943c94f41dfe36536dc9aaa12c9efdf548ceb996", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/f67ac0061c7614c1548963d3ef1ee1606efd8636", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-40992", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T17:01:44.819044Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T17:34:20.142Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/163868ec1f6c610d16da9e458fe1dd7d5de97341", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/943c94f41dfe36536dc9aaa12c9efdf548ceb996", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/f67ac0061c7614c1548963d3ef1ee1606efd8636", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T04:39:56.166Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-40992", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T17:01:44.819044Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T12:42:22.062Z"}}], "cna": {"title": "RDMA/rxe: Fix responder length checking for UD request packets", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "scenarios": [{"lang": "en", "value": "AV:N - The rxe driver processes RoCEv2 packets received on UDP port 4791 from arbitrary remote peers over routed IP networks, and the malformed UD request is handled directly in the responder receive path. No adjacency or local access is required.\nAC:L - A single crafted UD SEND packet whose payload exceeds the receiver's posted receive buffer deterministically triggers the wrong error class and the QP error transition; there is no race, no memory-layout dependency, and the GSI Q_Key is a hardcoded well-known constant.\nPR:N - RoCE provides no authentication, check_addr() performs no source validation for UD/GSI QPs, the default full P_Key always matches, and QPN 1 uses the fixed GSI_QKEY value \u2014 so a completely unauthenticated off-system attacker can reach the vulnerable code.\nUI:N - The vulnerability is triggered entirely by an inbound packet processed asynchronously by the responder task; no action by any local user or application is needed.\nS:U - The impact is confined to the kernel's RDMA subsystem on the target host, within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:N - copy_data() still bounds the transfer against dma.resid, so no out-of-bounds read occurs and no memory contents are disclosed; the defect is only the error code returned on an already-detected overlong payload.\nI:N - There is no memory corruption or out-of-bounds write \u2014 the receive-buffer copy remains bounded and the failure is reported to the application via an error completion, so no data is silently modified.\nA:H - A single unauthenticated packet permanently forces the UD/GSI queue pair into IB_QPS_ERR via rxe_qp_error(), flushing all work requests and rendering the QP unusable until the application tears it down and recreates it; killing QP1 disables the MAD agent and thus RDMA-CM connection establishment for the entire device, and one multicast packet can destroy every QP in a group."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "689c5421bfe0eac65526bd97a466b9590a6aad3c", "lessThan": "163868ec1f6c610d16da9e458fe1dd7d5de97341", "versionType": "git"}, {"status": "affected", "version": "689c5421bfe0eac65526bd97a466b9590a6aad3c", "lessThan": "943c94f41dfe36536dc9aaa12c9efdf548ceb996", "versionType": "git"}, {"status": "affected", "version": "689c5421bfe0eac65526bd97a466b9590a6aad3c", "lessThan": "f67ac0061c7614c1548963d3ef1ee1606efd8636", "versionType": "git"}], "programFiles": ["drivers/infiniband/sw/rxe/rxe_resp.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.2"}, {"status": "unaffected", "version": "0", "lessThan": "6.2", "versionType": "semver"}, {"status": "unaffected", "version": "6.6.36", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.9.7", "versionType": "semver", "lessThanOrEqual": "6.9.*"}, {"status": "unaffected", "version": "6.10", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/infiniband/sw/rxe/rxe_resp.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/163868ec1f6c610d16da9e458fe1dd7d5de97341"}, {"url": "https://git.kernel.org/stable/c/943c94f41dfe36536dc9aaa12c9efdf548ceb996"}, {"url": "https://git.kernel.org/stable/c/f67ac0061c7614c1548963d3ef1ee1606efd8636"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rxe: Fix responder length checking for UD request packets\n\nAccording to the IBA specification:\nIf a UD request packet is detected with an invalid length, the request\nshall be an invalid request and it shall be silently dropped by\nthe responder. The responder then waits for a new request packet.\n\ncommit 689c5421bfe0 (\"RDMA/rxe: Fix incorrect responder length checking\")\ndefers responder length check for UD QPs in function `copy_data`.\nBut it introduces a regression issue for UD QPs.\n\nWhen the packet size is too large to fit in the receive buffer.\n`copy_data` will return error code -EINVAL. Then `send_data_in`\nwill return RESPST_ERR_MALFORMED_WQE. UD QP will transfer into\nERROR state."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.36", "versionStartIncluding": "6.2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.9.7", "versionStartIncluding": "6.2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.10", "versionStartIncluding": "6.2"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:34:30.286Z"}}}, "cveMetadata": {"cveId": "CVE-2024-40992", "state": "PUBLISHED", "dateUpdated": "2026-08-05T11:34:30.286Z", "dateReserved": "2024-07-12T12:17:45.605Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-07-12T12:37:35.800Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/infiniband/sw/rxe/rxe_resp.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "163868ec1f6c610d16da9e458fe1dd7d5de97341", "status": "affected", "version": "689c5421bfe0eac65526bd97a466b9590a6aad3c", "versionType": "git"}, {"lessThan": "943c94f41dfe36536dc9aaa12c9efdf548ceb996", "status": "affected", "version": "689c5421bfe0eac65526bd97a466b9590a6aad3c", "versionType": "git"}, {"lessThan": "f67ac0061c7614c1548963d3ef1ee1606efd8636", "status": "affected", "version": "689c5421bfe0eac65526bd97a466b9590a6aad3c", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/infiniband/sw/rxe/rxe_resp.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.2"}, {"lessThan": "6.2", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.36", "versionType": "semver"}, {"lessThanOrEqual": "6.9.*", "status": "unaffected", "version": "6.9.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.10", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E1046C95-860A-45B0-B718-2B29F65BFF10", "versionEndExcluding": "6.6.36", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0A047AF2-94AC-4A3A-B32D-6AB930D8EF1C", "versionEndExcluding": "6.9.7", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.10:rc1:*:*:*:*:*:*", "matchCriteriaId": "2EBB4392-5FA6-4DA9-9772-8F9C750109FA", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.10:rc2:*:*:*:*:*:*", "matchCriteriaId": "331C2F14-12C7-45D5-893D-8C52EE38EA10", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.10:rc3:*:*:*:*:*:*", "matchCriteriaId": "3173713D-909A-4DD3-9DD4-1E171EB057EE", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.10:rc4:*:*:*:*:*:*", "matchCriteriaId": "79F18AFA-40F7-43F0-BA30-7BDB65F918B9", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rxe: Fix responder length checking for UD request packets\n\nAccording to the IBA specification:\nIf a UD request packet is detected with an invalid length, the request\nshall be an invalid request and it shall be silently dropped by\nthe responder. The responder then waits for a new request packet.\n\ncommit 689c5421bfe0 (\"RDMA/rxe: Fix incorrect responder length checking\")\ndefers responder length check for UD QPs in function `copy_data`.\nBut it introduces a regression issue for UD QPs.\n\nWhen the packet size is too large to fit in the receive buffer.\n`copy_data` will return error code -EINVAL. Then `send_data_in`\nwill return RESPST_ERR_MALFORMED_WQE. UD QP will transfer into\nERROR state."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: RDMA/rxe: corrige la comprobaci\u00f3n de la longitud del respondedor para los paquetes de solicitud UD. Seg\u00fan la especificaci\u00f3n IBA: si se detecta un paquete de solicitud UD con una longitud no v\u00e1lida, la solicitud ser\u00e1 una solicitud no v\u00e1lida y El respondedor lo dejar\u00e1 caer silenciosamente. Luego, el respondedor espera un nuevo paquete de solicitud. El commit 689c5421bfe0 (\"RDMA/rxe: corregir la verificaci\u00f3n incorrecta de la longitud del respondedor\") pospone la verificaci\u00f3n de la longitud del respondedor para los QP de UD en la funci\u00f3n `copy_data`. Pero introduce un problema de regresi\u00f3n para los QP de UD. Cuando el tama\u00f1o del paquete es demasiado grande para caber en el b\u00fafer de recepci\u00f3n. `copy_data` devolver\u00e1 el c\u00f3digo de error -EINVAL. Entonces `send_data_in` devolver\u00e1 RESPST_ERR_MALFORMED_WQE. UD QP pasar\u00e1 al estado ERROR."}], "id": "CVE-2024-40992", "lastModified": "2026-08-04T11:19:14.093", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-40992", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-09-10T17:01:44.819044Z", "version": "2.0.3"}}]}, "published": "2024-07-12T13:15:20.497", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/163868ec1f6c610d16da9e458fe1dd7d5de97341"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/943c94f41dfe36536dc9aaa12c9efdf548ceb996"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f67ac0061c7614c1548963d3ef1ee1606efd8636"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/163868ec1f6c610d16da9e458fe1dd7d5de97341"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/943c94f41dfe36536dc9aaa12c9efdf548ceb996"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f67ac0061c7614c1548963d3ef1ee1606efd8636"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: RDMA/rxe: Fix responder length checking for UD request packets", "id": "2297576", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2297576"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.4", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-20", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nRDMA/rxe: Fix responder length checking for UD request packets\nAccording to the IBA specification:\nIf a UD request packet is detected with an invalid length, the request\nshall be an invalid request and it shall be silently dropped by\nthe responder. The responder then waits for a new request packet.\ncommit 689c5421bfe0 (\"RDMA/rxe: Fix incorrect responder length checking\")\ndefers responder length check for UD QPs in function `copy_data`.\nBut it introduces a regression issue for UD QPs.\nWhen the packet size is too large to fit in the receive buffer.\n`copy_data` will return error code -EINVAL. Then `send_data_in`\nwill return RESPST_ERR_MALFORMED_WQE. UD QP will transfer into\nERROR state."], "name": "CVE-2024-40992", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-07-12T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-40992\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-40992\nhttps://lore.kernel.org/linux-cve-announce/2024071250-CVE-2024-40992-6554@gregkh/T"], "threat_severity": "Low"}

{"created": "2025-07-12T22:01:14.233893+00:00", "updated": "2025-07-12T22:01:14.233941+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}