What is CVE-2024-40940?

CVE-2024-40940 is a high-severity vulnerability in Linux, classified under Double Free. CVSS score: 7.8/10. Published 2024-07-12.

How severe is CVE-2024-40940?

High severity. CVSS v3 base score is 7.8 out of 10.

Double Free in Linux

CVE-2024-40940

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix tainted pointer delete is case of flow rules creation fail In case of flow rule creation fail in mlx5_lag_create_port_sel_table(), instead of previously created rules, the tainted pointer is deleted deveral times. Fix this bug by using correct flow rules pointers. Found by Linux Verification Center (linuxtesting.org) with SVACE.

Vulnerability class: Double Free

EPSS: 0.003 (17.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Linux — versions 352899f384d4aefa77ede6310d08c1b515612a8f, 5.19, 0
Linux Linux_kernel — versions 6.10

Weakness classification (CWE)

CWE-415 — Double Free

References

416baaa9-dc9f-4396-8d5f-8c081fb06d67 (Patch)
416baaa9-dc9f-4396-8d5f-8c081fb06d67 (Patch)
416baaa9-dc9f-4396-8d5f-8c081fb06d67 (Patch)
416baaa9-dc9f-4396-8d5f-8c081fb06d67 (Patch)
af854a3a-2127-422b-91ae-364da2661108

Frequently asked questions

What is CVE-2024-40940?: CVE-2024-40940 is a high-severity vulnerability in Linux, classified under Double Free. CVSS score: 7.8/10. Published 2024-07-12.
How severe is CVE-2024-40940?: High severity. CVSS v3 base score is 7.8 out of 10.