Security readout for executives and security teams
Plain-English summary
This is a Linux kernel driver flaw in bnxt_re. A specific hardware queue setup can trigger undefined shift behavior and potentially crash availability. It is not reported as actively exploited in the provided sources, and the CVSS profile requires local, high-privilege access.
Executive priority
Treat this as a scheduled kernel maintenance issue unless exposed systems support critical services using the affected driver. The main business risk is local privileged disruption of availability, not remote compromise based on the provided evidence.
Technical view
bnxt_qplib_alloc_init_hwq can call roundup_pow_of_two with aux_stride equal to zero when aux_depth is nonzero. The Linux kernel notes roundup_pow_of_two is undefined for zero, and UBSAN observed a shift-out-of-bounds condition during bnxt_re initialization paths.
Likely exposure
Exposure is most likely on Linux systems using affected kernel builds where the bnxt_re driver is present and reachable. The CVE data lists Linux as affected and includes stable kernel fix references, but does not provide CPEs or distribution-wide coverage.
Exploitation context
The supplied CVSS vector is local, low complexity, high privileges required, no user interaction, and high availability impact. CISA KEV status is false in the bundle, and no cited source states active exploitation.
Researcher notes
Evidence points to a correctness bug fixed in the Linux kernel stable trees. The source bundle does not prove remote reachability, data exposure, integrity impact, public exploit availability, or active exploitation. Avoid broad claims beyond local high-privilege availability impact.
Mitigation direction
- Apply Linux kernel updates containing the referenced stable fixes.
- Prioritize systems where bnxt_re is loaded or RDMA functionality is used.
- Check vendor or distribution advisories for packaged kernel availability.
- For Debian LTS environments, review the cited Debian announcement.
- Track exceptions where kernel updates require maintenance windows.
Validation and detection
- Inventory kernel versions against the CVE and distribution advisories.
- Check whether the bnxt_re module is present or loaded on hosts.
- Confirm patched kernels include one of the referenced stable commits.
- Review logs for UBSAN shift-out-of-bounds messages involving bnxt_re.
- Validate remediation through normal kernel package compliance tooling.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-38540 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 4.4 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H0.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
4.4MediumVector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/66a9937187ac9b5c5ffff07b8b284483e56804d1CVE reference, Linux
- https://git.kernel.org/stable/c/84d2f29152184f0d72ed7c9648c4ee6927df4e59CVE reference, Linux
- https://git.kernel.org/stable/c/a658f011d89dd20cf2c7cb4760ffd79201700b98CVE reference, Linux
- https://git.kernel.org/stable/c/627493443f3a8458cb55cdae1da254a7001123bcCVE reference, Linux
- https://git.kernel.org/stable/c/8b799c00cea6fcfe5b501bbaeb228c8821acb753CVE reference, Linux
- https://git.kernel.org/stable/c/78cfd17142ef70599d6409cbd709d94b3da58659CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.