Security readout for executives and security teams
Plain-English summary
A local, low-privileged user could provide an excessive value to the Linux mlx5 RDMA driver because it was not checked before use. The supplied severity assessment indicates potentially serious confidentiality, integrity, and availability consequences. Exposure appears limited to systems using the affected mlx5 RDMA functionality, rather than all Linux systems equally.
Executive priority
Prioritize remediation as high for shared, multi-user, or sensitive systems using mlx5 RDMA. Treat ordinary Linux hosts without that functionality as lower-priority pending validation. This is not supported as an active-exploitation emergency, but the high potential impact and low-complexity local attack conditions justify timely patching.
Technical view
The mlx5 shared receive queue path accepted the user-controlled max_sge attribute without verifying it against the permitted maximum. The correction adds that bounds check before the value is used. CVSS 3.1 is 7.8 with local, low-complexity, low-privilege access and high potential impact. The sources do not describe the resulting failure primitive or a CWE.
Likely exposure
Likely exposure is concentrated on Linux hosts using mlx5 RDMA shared receive queues and permitting low-privileged local access. The supplied affected-version data names releases from 3.11 through 6.10, but its exact range semantics are unclear. Confirm exposure using distribution advisories and backport records rather than version numbers alone.
Exploitation context
The bundle marks this CVE as absent from KEV, and no supplied source reports active exploitation or a public exploit. Exploitation requires local access with low privileges according to the CVSS vector. This lowers internet-wide urgency but remains important on shared compute, research, or other multi-user RDMA systems.
Researcher notes
The source bundle establishes unchecked user input and the added maximum-value validation, but it does not explain the downstream corruption or failure mechanism. It also supplies ambiguous affected-version entries and no CWE. Researchers should review the stable patches and distribution backports when determining exact exposure, without inferring exploitability beyond the CVSS assessment.
Mitigation direction
- Upgrade to a vendor-supported kernel containing the referenced max_sge bounds check or an equivalent backport.
- Consult the operating-system vendor advisory to identify the corrected package for each deployed distribution.
- Prioritize shared or multi-user hosts that actively use mlx5 RDMA functionality.
- Apply normal restrictions on untrusted local access while affected systems await kernel updates.
Validation and detection
- Inventory kernel packages and identify hosts that actively use mlx5 RDMA functionality.
- Confirm the installed kernel includes a referenced stable commit or documented vendor backport.
- Reboot into the corrected kernel and verify the running version matches the updated package.
- Reassess scanner findings using distribution-specific package status rather than upstream version comparisons alone.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-40990 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/7186b81c1f15e39069b1af172c6a951728ed3511CVE reference, Linux
- https://git.kernel.org/stable/c/1e692244bf7dd827dd72edc6c4a3b36ae572f03cCVE reference, Linux
- https://git.kernel.org/stable/c/999586418600b4b3b93c2a0edd3a4ca71ee759bfCVE reference, Linux
- https://git.kernel.org/stable/c/e0deb0e9c967b61420235f7f17a4450b4b4d6ce2CVE reference, Linux
- https://git.kernel.org/stable/c/4ab99e3613139f026d2d8ba954819e2876120ab3CVE reference, Linux
- https://git.kernel.org/stable/c/36ab7ada64caf08f10ee5a114d39964d1f91e81dCVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.