Security readout for executives and security teams
Plain-English summary
A Linux GVE network-driver error can leave a reference to network data after that memory is freed. Reusing the stale reference could cause kernel memory corruption, potentially affecting confidentiality, integrity, or availability. Exposure appears limited to systems running an affected kernel with the GVE driver in use.
Executive priority
Treat as an urgent kernel patching issue where GVE is active, especially on exposed or business-critical hosts. Do not assume every Linux system is vulnerable. Require asset owners to establish driver use and package-level fix status, then expedite confirmed exposures through normal kernel update and reboot procedures.
Technical view
gve_rx_free_skb() frees an skb through dev_kfree_skb_any() without first clearing napi->skb. A later napi_get_frags() call can therefore return a dangling pointer, creating a kernel use-after-free condition. The stable fix clears napi->skb before freeing the skb.
Likely exposure
Prioritize Linux systems that use the GVE network driver and run affected kernel builds. The bundle lists affected versions across several kernel lines, but its version data is incomplete or ambiguous. Confirm exposure using the exact distribution kernel package, driver usage, and vendor advisory status.
Exploitation context
The supplied CVSS 3.1 score is 9.8 with network attack vector and no required privileges or user interaction. However, the sources provided do not document practical prerequisites, public exploitation, or active attacks. This CVE is not identified as KEV in the bundle.
Researcher notes
The core defect is a stale napi->skb reference after skb deallocation. The source bundle supplies multiple stable commits but does not map each commit clearly to every affected or fixed release. It also provides no demonstrated exploit chain. Package-level assessment should therefore rely on distribution backport information rather than upstream version numbers alone.
Mitigation direction
- Install a vendor-supported kernel containing the applicable stable fix.
- Follow distribution advisories to map fixed packages to deployed kernel versions.
- Prioritize internet-facing or untrusted-network systems actively using the GVE driver.
- Use vendor guidance for temporary risk reduction when immediate kernel replacement is unavailable.
Validation and detection
- Record the running kernel and installed kernel package versions.
- Confirm whether the GVE driver is loaded and bound to an active interface.
- Compare deployed packages with distribution advisories and listed stable fixes.
- After updating, reboot into the fixed kernel and verify the running version.
- Monitor kernel logs for network-driver faults or memory-corruption symptoms.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-40937 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9LinuxVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/75afd8724739ee5ed8165acde5f6ac3988b485ccCVE reference, Linux
- https://git.kernel.org/stable/c/d221284991118c0ab16480b53baecd857c0bc442CVE reference, Linux
- https://git.kernel.org/stable/c/2ce5341c36993b776012601921d7688693f8c037CVE reference, Linux
- https://git.kernel.org/stable/c/a68184d5b420ea4fc7e6b7ceb52bbc66f90d3c50CVE reference, Linux
- https://git.kernel.org/stable/c/6f4d93b78ade0a4c2cafd587f7b429ce95abb02eCVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.