Security readout for executives and security teams
Plain-English summary
A Linux kernel memory-management flaw can select the wrong memory-control LRU data and lock while replacing shared-memory pages during swap-in. This may cause kernel warnings, LRU list crashes, or incorrect memory statistics. The CVSS assessment rates potential confidentiality, integrity, and availability impact high, but the supplied sources do not establish a practical exploit.
Executive priority
Treat this as a high-priority kernel remediation, especially for multi-user Linux hosts or systems running untrusted local workloads. Inventory affected kernels promptly and deploy verified vendor backports during an urgent maintenance window. The supplied evidence does not justify declaring active compromise solely because a vulnerable version is present.
Technical view
During shmem folio replacement, mem_cgroup_migrate() clears the old folio’s memory-cgroup data before LRU removal. The kernel may therefore obtain an incorrect lruvec and hold the wrong LRU lock while freeing the folio. The referenced fix replaces this behavior with mem_cgroup_replace_folio().
Likely exposure
Exposure is limited to affected Linux kernels and requires local access according to the CVSS vector. Multi-user systems and hosts running untrusted local workloads deserve particular attention. The supplied version data includes Linux 6.7, 6.9.7, and 6.10-related entries, but distributors may backport fixes, so version strings alone are insufficient.
Exploitation context
The CVSS vector describes a low-complexity, low-privilege local attack requiring no user interaction. CISA KEV status is false, and the supplied sources provide no evidence of active exploitation or a public exploit. They document a warning observed during shmem swap-in testing and potentially serious kernel consequences.
Researcher notes
The reported failure path runs through shmem_replace_folio(), shmem_swapin_folio(), and folio_lruvec_lock_irqsave(). Evidence supports incorrect locking, possible LRU list crashes, and inaccurate statistics. No CWE is supplied, and the sources do not demonstrate reliable exploitation, privilege escalation, or the conditions needed to realize the CVSS confidentiality and integrity impacts.
Mitigation direction
- Apply a vendor kernel update containing one of the referenced stable fixes.
- Check distribution advisories for backport status because package versions may differ from upstream releases.
- Prioritize multi-user systems and hosts that execute untrusted local workloads.
- Reboot updated systems when required to activate the corrected kernel.
Validation and detection
- Inventory running kernel versions across Linux systems and compare them with vendor advisories.
- Confirm the installed kernel includes a referenced fix or documented vendor backport.
- Review kernel logs for folio_lruvec_lock_irqsave warnings and related shmem swap-in traces.
- After remediation, confirm systems are running the updated kernel and monitor for recurrence.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-40949 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/8c6c3719ebb7913f8a665d11816d2e38b0eadbabCVE reference, Linux
- https://git.kernel.org/stable/c/9094b4a1c76cfe84b906cc152bab34d4ba26fa5cCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.