Security readout for executives and security teams
Plain-English summary
CVE-2024-40947 is a Linux kernel IMA bug where policy checking can sleep inside an RCU critical section. The source describes possible use-after-free behavior and a kernel panic. Business impact is primarily reliability and host availability risk on affected kernels, not confirmed remote compromise.
Executive priority
Treat as a scheduled kernel reliability fix unless your Linux fleet relies heavily on IMA or has exposed instability. Escalate for critical servers where host panic would affect service availability. There is no source-backed evidence of active exploitation.
Technical view
The vulnerable path is ima_match_policy after commit c7423dbdbc9e added ima_lsm_copy_rule inside rcu_read_lock. That path can allocate with GFP_KERNEL and sleep, allowing synchronize_rcu to return early on non-PREEMPT systems. The fix changes these allocations to GFP_ATOMIC.
Likely exposure
Exposure is Linux systems running affected kernel versions or downstream packages containing the faulty IMA change. Risk is most relevant where IMA policy evaluation is enabled or exercised. The bundle lists affected Linux versions including 5.10.222, 5.15.163, 6.1.98, 6.6.39, 6.9.7, and 6.10.
Exploitation context
The bundle does not report active exploitation, and KEV is false. The described failure can occur through kernel IMA policy evaluation and may cause panic through use-after-free behavior. No public exploit technique, attacker prerequisites, or remote attack path is established in the provided evidence.
Researcher notes
The source identifies a concurrency bug in IMA caused by GFP_KERNEL allocation under RCU read-side locking. The practical trigger conditions and attacker control are not fully described. Analysis should focus on affected kernel lineage, IMA configuration, and whether downstream kernels backported the faulty commit or fix.
Mitigation direction
- Update to a Linux kernel containing the referenced stable fixes.
- Use distribution security advisories for exact package versions and reboot requirements.
- Prioritize systems using IMA or strict integrity measurement policies.
- If patching is delayed, monitor vendor guidance for supported mitigations.
- Do not deploy custom kernel workarounds without vendor validation.
Validation and detection
- Inventory kernel versions across servers, containers hosts, and appliances.
- Check whether IMA is enabled and policies are loaded.
- Map running kernels against vendor fixed package advisories.
- Review kernel logs for IMA-related panics or crashes.
- Confirm patched systems boot into the updated kernel.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-40947 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/a6176a802c4bfb83bf7524591aa75f44a639a853CVE reference, Linux
- https://git.kernel.org/stable/c/a38e02265c681b51997a264aaf743095e2ee400aCVE reference, Linux
- https://git.kernel.org/stable/c/9c3906c3738562b1fedc6f1cfc81756a7cfefff0CVE reference, Linux
- https://git.kernel.org/stable/c/28d0ecc52f6c927d0e9ba70a4f2c1ea15453ee88CVE reference, Linux
- https://git.kernel.org/stable/c/58275455893066149e9f4df2223ab2fdbdc59f9cCVE reference, Linux
- https://git.kernel.org/stable/c/9a95c5bfbf02a0a7f5983280fe284a0ff0836c34CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.