Security readout for executives and security teams
Plain-English summary
A Linux kernel socket-creation failure can leave a pointer to freed memory. Under specific local conditions involving an attached fentry BPF probe, later access can trigger a use-after-free. The supplied CVSS 3.1 score is 7.8, reflecting potential confidentiality, integrity, and availability impact, but the sources do not establish real-world exploitation.
Executive priority
Prioritize normal high-severity kernel patching, especially on multi-user, development, observability, or research systems where BPF tracing is available. Accelerate remediation for untrusted local-user environments. There is no supplied evidence of active exploitation or a remote attack path, so emergency incident response is not justified solely by this CVE record.
Technical view
When a protocol-family socket creation path attaches a struct socket reference using sock_init_data() and subsequently fails, the sk pointer can remain dangling. An fentry probe on __sock_release() calling bpf_get_socket_cookie() may access the freed object. The fix clears the socket reference in sk_common_release(), covering affected protocol-family creation paths.
Likely exposure
Potential exposure exists on affected Linux kernel releases, including listed 5.12 through 6.10-era versions, where a local user can satisfy the required probe and failure conditions. Exact exposure depends on distribution backports, the running kernel build, and whether the necessary BPF tracing capability is available. The supplied version data is insufficient for package-level conclusions.
Exploitation context
The source bundle marks this CVE as absent from KEV and provides no evidence of active exploitation. It documents a KASAN-detected reproduction requiring an fentry probe and a socket-creation failure. Treat this as a locally triggered kernel memory-safety flaw, not a demonstrated remote compromise path.
Researcher notes
The reported read occurs in __sock_gen_cookie() through bpf_get_socket_ptr_cookie() during __sock_release(). The object was freed during a failed inet_create() path. Stable fixes clear the struct socket reference in sk_common_release(). The bundle lists multiple branch-specific commits; distribution kernels may contain backports without matching upstream version numbers.
Mitigation direction
- Install the distribution-supported kernel update containing the applicable stable fix.
- Reboot systems so the corrected kernel is actually running.
- Check vendor advisories and package changelogs for CVE-2024-40954 backport status.
- Restrict unnecessary local access and BPF tracing capability until patching is complete.
Validation and detection
- Inventory running kernel versions and distribution package build identifiers.
- Confirm the installed kernel changelog includes CVE-2024-40954 or the applicable stable commit.
- Verify every updated system booted into the patched kernel.
- Review kernel diagnostics for related KASAN slab-use-after-free reports where such instrumentation is enabled.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-40954 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/78e4aa528a7b1204219d808310524344f627d069CVE reference, Linux
- https://git.kernel.org/stable/c/893eeba94c40d513cd0fe6539330ebdaea208c0eCVE reference, Linux
- https://git.kernel.org/stable/c/454c454ed645fed051216b79622f7cb69c1638f5CVE reference, Linux
- https://git.kernel.org/stable/c/5dfe2408fd7dc4d2e7ac38a116ff0a37b1cfd3b9CVE reference, Linux
- https://git.kernel.org/stable/c/6cd4a78d962bebbaf8beb7d2ead3f34120e3f7b2CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.