CVE-2024-40992 (GCVE-0-2024-40992)

Vulnerability from cvelistv5 – Published: 2024-07-12 12:37 – Updated: 2026-08-05 11:34
VLAI
Title
RDMA/rxe: Fix responder length checking for UD request packets
Summary
In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix responder length checking for UD request packets According to the IBA specification: If a UD request packet is detected with an invalid length, the request shall be an invalid request and it shall be silently dropped by the responder. The responder then waits for a new request packet. commit 689c5421bfe0 ("RDMA/rxe: Fix incorrect responder length checking") defers responder length check for UD QPs in function `copy_data`. But it introduces a regression issue for UD QPs. When the packet size is too large to fit in the receive buffer. `copy_data` will return error code -EINVAL. Then `send_data_in` will return RESPST_ERR_MALFORMED_WQE. UD QP will transfer into ERROR state.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 689c5421bfe0eac65526bd97a466b9590a6aad3c , < 163868ec1f6c610d16da9e458fe1dd7d5de97341 (git)
Affected: 689c5421bfe0eac65526bd97a466b9590a6aad3c , < 943c94f41dfe36536dc9aaa12c9efdf548ceb996 (git)
Affected: 689c5421bfe0eac65526bd97a466b9590a6aad3c , < f67ac0061c7614c1548963d3ef1ee1606efd8636 (git)
Create a notification for this product.
Linux Linux Affected: 6.2
Unaffected: 0 , < 6.2 (semver)
Unaffected: 6.6.36 , ≤ 6.6.* (semver)
Unaffected: 6.9.7 , ≤ 6.9.* (semver)
Unaffected: 6.10 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T04:39:56.166Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/163868ec1f6c610d16da9e458fe1dd7d5de97341"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/943c94f41dfe36536dc9aaa12c9efdf548ceb996"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/f67ac0061c7614c1548963d3ef1ee1606efd8636"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-40992",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T17:01:44.819044Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:34:20.142Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/sw/rxe/rxe_resp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "163868ec1f6c610d16da9e458fe1dd7d5de97341",
              "status": "affected",
              "version": "689c5421bfe0eac65526bd97a466b9590a6aad3c",
              "versionType": "git"
            },
            {
              "lessThan": "943c94f41dfe36536dc9aaa12c9efdf548ceb996",
              "status": "affected",
              "version": "689c5421bfe0eac65526bd97a466b9590a6aad3c",
              "versionType": "git"
            },
            {
              "lessThan": "f67ac0061c7614c1548963d3ef1ee1606efd8636",
              "status": "affected",
              "version": "689c5421bfe0eac65526bd97a466b9590a6aad3c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/sw/rxe/rxe_resp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.2"
            },
            {
              "lessThan": "6.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.36",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.10",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.36",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9.7",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rxe: Fix responder length checking for UD request packets\n\nAccording to the IBA specification:\nIf a UD request packet is detected with an invalid length, the request\nshall be an invalid request and it shall be silently dropped by\nthe responder. The responder then waits for a new request packet.\n\ncommit 689c5421bfe0 (\"RDMA/rxe: Fix incorrect responder length checking\")\ndefers responder length check for UD QPs in function `copy_data`.\nBut it introduces a regression issue for UD QPs.\n\nWhen the packet size is too large to fit in the receive buffer.\n`copy_data` will return error code -EINVAL. Then `send_data_in`\nwill return RESPST_ERR_MALFORMED_WQE. UD QP will transfer into\nERROR state."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The rxe driver processes RoCEv2 packets received on UDP port 4791 from arbitrary remote peers over routed IP networks, and the malformed UD request is handled directly in the responder receive path. No adjacency or local access is required.\nAC:L - A single crafted UD SEND packet whose payload exceeds the receiver\u0027s posted receive buffer deterministically triggers the wrong error class and the QP error transition; there is no race, no memory-layout dependency, and the GSI Q_Key is a hardcoded well-known constant.\nPR:N - RoCE provides no authentication, check_addr() performs no source validation for UD/GSI QPs, the default full P_Key always matches, and QPN 1 uses the fixed GSI_QKEY value \u2014 so a completely unauthenticated off-system attacker can reach the vulnerable code.\nUI:N - The vulnerability is triggered entirely by an inbound packet processed asynchronously by the responder task; no action by any local user or application is needed.\nS:U - The impact is confined to the kernel\u0027s RDMA subsystem on the target host, within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:N - copy_data() still bounds the transfer against dma.resid, so no out-of-bounds read occurs and no memory contents are disclosed; the defect is only the error code returned on an already-detected overlong payload.\nI:N - There is no memory corruption or out-of-bounds write \u2014 the receive-buffer copy remains bounded and the failure is reported to the application via an error completion, so no data is silently modified.\nA:H - A single unauthenticated packet permanently forces the UD/GSI queue pair into IB_QPS_ERR via rxe_qp_error(), flushing all work requests and rendering the QP unusable until the application tears it down and recreates it; killing QP1 disables the MAD agent and thus RDMA-CM connection establishment for the entire device, and one multicast packet can destroy every QP in a group."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:34:30.286Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/163868ec1f6c610d16da9e458fe1dd7d5de97341"
        },
        {
          "url": "https://git.kernel.org/stable/c/943c94f41dfe36536dc9aaa12c9efdf548ceb996"
        },
        {
          "url": "https://git.kernel.org/stable/c/f67ac0061c7614c1548963d3ef1ee1606efd8636"
        }
      ],
      "title": "RDMA/rxe: Fix responder length checking for UD request packets",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-40992",
    "datePublished": "2024-07-12T12:37:35.800Z",
    "dateReserved": "2024-07-12T12:17:45.605Z",
    "dateUpdated": "2026-08-05T11:34:30.286Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-40992",
      "date": "2026-08-06",
      "epss": "0.00606",
      "percentile": "0.45646"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-40992\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-07-12T13:15:20.497\",\"lastModified\":\"2026-06-17T07:47:02.257\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nRDMA/rxe: Fix responder length checking for UD request packets\\n\\nAccording to the IBA specification:\\nIf a UD request packet is detected with an invalid length, the request\\nshall be an invalid request and it shall be silently dropped by\\nthe responder. The responder then waits for a new request packet.\\n\\ncommit 689c5421bfe0 (\\\"RDMA/rxe: Fix incorrect responder length checking\\\")\\ndefers responder length check for UD QPs in function `copy_data`.\\nBut it introduces a regression issue for UD QPs.\\n\\nWhen the packet size is too large to fit in the receive buffer.\\n`copy_data` will return error code -EINVAL. Then `send_data_in`\\nwill return RESPST_ERR_MALFORMED_WQE. UD QP will transfer into\\nERROR state.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: RDMA/rxe: corrige la comprobaci\u00f3n de la longitud del respondedor para los paquetes de solicitud UD. Seg\u00fan la especificaci\u00f3n IBA: si se detecta un paquete de solicitud UD con una longitud no v\u00e1lida, la solicitud ser\u00e1 una solicitud no v\u00e1lida y El respondedor lo dejar\u00e1 caer silenciosamente. Luego, el respondedor espera un nuevo paquete de solicitud. El commit 689c5421bfe0 (\\\"RDMA/rxe: corregir la verificaci\u00f3n incorrecta de la longitud del respondedor\\\") pospone la verificaci\u00f3n de la longitud del respondedor para los QP de UD en la funci\u00f3n `copy_data`. Pero introduce un problema de regresi\u00f3n para los QP de UD. Cuando el tama\u00f1o del paquete es demasiado grande para caber en el b\u00fafer de recepci\u00f3n. `copy_data` devolver\u00e1 el c\u00f3digo de error -EINVAL. Entonces `send_data_in` devolver\u00e1 RESPST_ERR_MALFORMED_WQE. UD QP pasar\u00e1 al estado ERROR.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/infiniband/sw/rxe/rxe_resp.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"689c5421bfe0eac65526bd97a466b9590a6aad3c\",\"lessThan\":\"163868ec1f6c610d16da9e458fe1dd7d5de97341\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"689c5421bfe0eac65526bd97a466b9590a6aad3c\",\"lessThan\":\"943c94f41dfe36536dc9aaa12c9efdf548ceb996\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"689c5421bfe0eac65526bd97a466b9590a6aad3c\",\"lessThan\":\"f67ac0061c7614c1548963d3ef1ee1606efd8636\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/infiniband/sw/rxe/rxe_resp.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.2\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.2\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.36\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.9.7\",\"lessThanOrEqual\":\"6.9.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-10T17:01:44.819044Z\",\"id\":\"CVE-2024-40992\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.36\",\"matchCriteriaId\":\"E1046C95-860A-45B0-B718-2B29F65BFF10\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.9.7\",\"matchCriteriaId\":\"0A047AF2-94AC-4A3A-B32D-6AB930D8EF1C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.10:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"2EBB4392-5FA6-4DA9-9772-8F9C750109FA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.10:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"331C2F14-12C7-45D5-893D-8C52EE38EA10\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.10:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"3173713D-909A-4DD3-9DD4-1E171EB057EE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.10:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"79F18AFA-40F7-43F0-BA30-7BDB65F918B9\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/163868ec1f6c610d16da9e458fe1dd7d5de97341\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/943c94f41dfe36536dc9aaa12c9efdf548ceb996\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f67ac0061c7614c1548963d3ef1ee1606efd8636\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/163868ec1f6c610d16da9e458fe1dd7d5de97341\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/943c94f41dfe36536dc9aaa12c9efdf548ceb996\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f67ac0061c7614c1548963d3ef1ee1606efd8636\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T22:44:01+00:00",
      "cve": "CVE-2024-40992",
      "id": "CVE-2024-40992",
      "initial_release_date": "2024-07-12T00:00:00+00:00",
      "product_status:known_affected": "136",
      "product_status:known_not_affected": "62",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: RDMA/rxe: Fix responder length checking for UD request packets",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-40992.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/163868ec1f6c610d16da9e458fe1dd7d5de97341\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/943c94f41dfe36536dc9aaa12c9efdf548ceb996\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/f67ac0061c7614c1548963d3ef1ee1606efd8636\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T04:39:56.166Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-40992\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T17:01:44.819044Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:22.062Z\"}}], \"cna\": {\"title\": \"RDMA/rxe: Fix responder length checking for UD request packets\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.5, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:N - The rxe driver processes RoCEv2 packets received on UDP port 4791 from arbitrary remote peers over routed IP networks, and the malformed UD request is handled directly in the responder receive path. No adjacency or local access is required.\\nAC:L - A single crafted UD SEND packet whose payload exceeds the receiver\u0027s posted receive buffer deterministically triggers the wrong error class and the QP error transition; there is no race, no memory-layout dependency, and the GSI Q_Key is a hardcoded well-known constant.\\nPR:N - RoCE provides no authentication, check_addr() performs no source validation for UD/GSI QPs, the default full P_Key always matches, and QPN 1 uses the fixed GSI_QKEY value \\u2014 so a completely unauthenticated off-system attacker can reach the vulnerable code.\\nUI:N - The vulnerability is triggered entirely by an inbound packet processed asynchronously by the responder task; no action by any local user or application is needed.\\nS:U - The impact is confined to the kernel\u0027s RDMA subsystem on the target host, within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\\nC:N - copy_data() still bounds the transfer against dma.resid, so no out-of-bounds read occurs and no memory contents are disclosed; the defect is only the error code returned on an already-detected overlong payload.\\nI:N - There is no memory corruption or out-of-bounds write \\u2014 the receive-buffer copy remains bounded and the failure is reported to the application via an error completion, so no data is silently modified.\\nA:H - A single unauthenticated packet permanently forces the UD/GSI queue pair into IB_QPS_ERR via rxe_qp_error(), flushing all work requests and rendering the QP unusable until the application tears it down and recreates it; killing QP1 disables the MAD agent and thus RDMA-CM connection establishment for the entire device, and one multicast packet can destroy every QP in a group.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"689c5421bfe0eac65526bd97a466b9590a6aad3c\", \"lessThan\": \"163868ec1f6c610d16da9e458fe1dd7d5de97341\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"689c5421bfe0eac65526bd97a466b9590a6aad3c\", \"lessThan\": \"943c94f41dfe36536dc9aaa12c9efdf548ceb996\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"689c5421bfe0eac65526bd97a466b9590a6aad3c\", \"lessThan\": \"f67ac0061c7614c1548963d3ef1ee1606efd8636\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/infiniband/sw/rxe/rxe_resp.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.2\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.2\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.6.36\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9.7\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.9.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/infiniband/sw/rxe/rxe_resp.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/163868ec1f6c610d16da9e458fe1dd7d5de97341\"}, {\"url\": \"https://git.kernel.org/stable/c/943c94f41dfe36536dc9aaa12c9efdf548ceb996\"}, {\"url\": \"https://git.kernel.org/stable/c/f67ac0061c7614c1548963d3ef1ee1606efd8636\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nRDMA/rxe: Fix responder length checking for UD request packets\\n\\nAccording to the IBA specification:\\nIf a UD request packet is detected with an invalid length, the request\\nshall be an invalid request and it shall be silently dropped by\\nthe responder. The responder then waits for a new request packet.\\n\\ncommit 689c5421bfe0 (\\\"RDMA/rxe: Fix incorrect responder length checking\\\")\\ndefers responder length check for UD QPs in function `copy_data`.\\nBut it introduces a regression issue for UD QPs.\\n\\nWhen the packet size is too large to fit in the receive buffer.\\n`copy_data` will return error code -EINVAL. Then `send_data_in`\\nwill return RESPST_ERR_MALFORMED_WQE. UD QP will transfer into\\nERROR state.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.36\", \"versionStartIncluding\": \"6.2\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9.7\", \"versionStartIncluding\": \"6.2\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10\", \"versionStartIncluding\": \"6.2\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:34:30.286Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-40992\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:34:30.286Z\", \"dateReserved\": \"2024-07-12T12:17:45.605Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-07-12T12:37:35.800Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.