Security readout for executives and security teams
Plain-English summary
CVE-2024-40959 is a Linux kernel bug in IPv6 IPsec/XFRM handling. A missing NULL check can cause a kernel fault when source address selection encounters an unexpected missing device reference. The main business risk shown by the sources is system instability or denial of service, not data theft or remote code execution.
Executive priority
Treat this as a stability and availability issue requiring normal kernel patch governance. Escalate priority for network infrastructure, VPN gateways, industrial appliances, or exposed Linux systems using IPv6/IPsec paths. No source provided evidence of active exploitation, so emergency response is not justified from this bundle alone.
Technical view
The fix adds handling for ip6_dst_idev() returning NULL in xfrm6_get_saddr(). Syzbot observed a KASAN NULL pointer dereference/general protection fault in the IPv6 XFRM policy path, reached during packet handling. The CVE record lists affected Linux kernel versions and multiple stable backport commits.
Likely exposure
Exposure is most relevant to systems running affected Linux kernels with IPv6 and XFRM/IPsec networking paths in use. The syzbot trace includes WireGuard as a caller, but the resolved flaw is in Linux IPv6 XFRM source address selection, not identified as a WireGuard product vulnerability.
Exploitation context
The source bundle does not show CISA KEV listing, active exploitation, public exploit details, or CVSS scoring. Evidence supports a kernel crash condition found by syzbot. Practical exploitability, required privileges, and network reachability are not fully established in the provided sources.
Researcher notes
The affected component is net/ipv6/xfrm6_policy.c. The vulnerable behavior is failure to handle a NULL ip6_dst_idev() result. The crash trace passes through XFRM bundle resolution and IPv6 route lookup. Version impact should be confirmed through distribution backports rather than upstream version strings alone.
Mitigation direction
- Update to a vendor-supported kernel containing the referenced stable fix.
- Review Debian, Siemens, and OS vendor advisories for affected packaged kernels.
- Prioritize internet-facing, VPN, router, and IPv6/IPsec-enabled Linux systems.
- Avoid unsupported kernels where stable security backports are unavailable.
- Follow vendor guidance if patch timing or appliance firmware constraints apply.
Validation and detection
- Inventory Linux kernel versions across servers, appliances, and embedded deployments.
- Compare installed kernels against vendor advisories and fixed stable commits.
- Check whether IPv6, XFRM, IPsec, or related VPN networking paths are enabled.
- Review kernel logs for xfrm6_get_saddr, KASAN, oops, or general protection faults.
- Confirm patched kernel packages are installed and active after reboot.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-40959 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/c71761292d4d002a8eccb57b86792c4e3b3eb3c7CVE reference, Linux
- https://git.kernel.org/stable/c/caf0bec84c62fb1cf6f7c9f0e8c857c87f8adbc3CVE reference, Linux
- https://git.kernel.org/stable/c/20427b85781aca0ad072851f6907a3d4b2fed8d1CVE reference, Linux
- https://git.kernel.org/stable/c/9f30f1f1a51d91e19f5a09236bb0b59e6a07ad08CVE reference, Linux
- https://git.kernel.org/stable/c/83c02fb2cc0afee5bb53cddf3f34f045f654ad6aCVE reference, Linux
- https://git.kernel.org/stable/c/f897d7171652fcfc76d042bfec798b010ee89e41CVE reference, Linux
- https://git.kernel.org/stable/c/600a62b4232ac027f788c3ca395bc2333adeaacfCVE reference, Linux
- https://git.kernel.org/stable/c/d46401052c2d5614da8efea5788532f0401cb164CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.htmlCVE reference, CVE
- https://cert-portal.siemens.com/productcert/html/ssa-398330.htmlCVE reference, siemens-SADP
- https://cert-portal.siemens.com/productcert/html/ssa-265688.htmlCVE reference, siemens-SADP
- https://cert-portal.siemens.com/productcert/html/ssa-613116.htmlCVE reference, siemens-SADP
- https://cert-portal.siemens.com/productcert/html/ssa-355557.htmlCVE reference, siemens-SADP
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.