CVE-2024-40956 (GCVE-0-2024-40956)

Vulnerability from cvelistv5 – Published: 2024-07-12 12:31 – Updated: 2026-08-05 11:34
VLAI
Title
dmaengine: idxd: Fix possible Use-After-Free in irq_process_work_list
Summary
In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: Fix possible Use-After-Free in irq_process_work_list Use list_for_each_entry_safe() to allow iterating through the list and deleting the entry in the iteration process. The descriptor is freed via idxd_desc_complete() and there's a slight chance may cause issue for the list iterator when the descriptor is reused by another thread without it being deleted from the list.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 16e19e11228ba660d9e322035635e7dcf160d5c2 , < 1b08bf5a17c66ab7dbb628df5344da53c8e7ab33 (git)
Affected: 16e19e11228ba660d9e322035635e7dcf160d5c2 , < 83163667d881100a485b6c2daa30301b7f68d9b5 (git)
Affected: 16e19e11228ba660d9e322035635e7dcf160d5c2 , < faa35db78b058a2ab6e074ee283f69fa398c36a8 (git)
Affected: 16e19e11228ba660d9e322035635e7dcf160d5c2 , < a14968921486793f2a956086895c3793761309dd (git)
Affected: 16e19e11228ba660d9e322035635e7dcf160d5c2 , < e3215deca4520773cd2b155bed164c12365149a7 (git)
Create a notification for this product.
Linux Linux Affected: 5.11
Unaffected: 0 , < 5.11 (semver)
Unaffected: 5.15.162 , ≤ 5.15.* (semver)
Unaffected: 6.1.96 , ≤ 6.1.* (semver)
Unaffected: 6.6.36 , ≤ 6.6.* (semver)
Unaffected: 6.9.7 , ≤ 6.9.* (semver)
Unaffected: 6.10 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T21:58:20.070Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/1b08bf5a17c66ab7dbb628df5344da53c8e7ab33"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/83163667d881100a485b6c2daa30301b7f68d9b5"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/faa35db78b058a2ab6e074ee283f69fa398c36a8"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/a14968921486793f2a956086895c3793761309dd"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e3215deca4520773cd2b155bed164c12365149a7"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-40956",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T17:03:42.094021Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:34:24.154Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/dma/idxd/irq.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1b08bf5a17c66ab7dbb628df5344da53c8e7ab33",
              "status": "affected",
              "version": "16e19e11228ba660d9e322035635e7dcf160d5c2",
              "versionType": "git"
            },
            {
              "lessThan": "83163667d881100a485b6c2daa30301b7f68d9b5",
              "status": "affected",
              "version": "16e19e11228ba660d9e322035635e7dcf160d5c2",
              "versionType": "git"
            },
            {
              "lessThan": "faa35db78b058a2ab6e074ee283f69fa398c36a8",
              "status": "affected",
              "version": "16e19e11228ba660d9e322035635e7dcf160d5c2",
              "versionType": "git"
            },
            {
              "lessThan": "a14968921486793f2a956086895c3793761309dd",
              "status": "affected",
              "version": "16e19e11228ba660d9e322035635e7dcf160d5c2",
              "versionType": "git"
            },
            {
              "lessThan": "e3215deca4520773cd2b155bed164c12365149a7",
              "status": "affected",
              "version": "16e19e11228ba660d9e322035635e7dcf160d5c2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/dma/idxd/irq.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.11"
            },
            {
              "lessThan": "5.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.162",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.36",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.10",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.162",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.96",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.36",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9.7",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: idxd: Fix possible Use-After-Free in irq_process_work_list\n\nUse list_for_each_entry_safe() to allow iterating through the list and\ndeleting the entry in the iteration process. The descriptor is freed via\nidxd_desc_complete() and there\u0027s a slight chance may cause issue for\nthe list iterator when the descriptor is reused by another thread\nwithout it being deleted from the list."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is the idxd (Intel DSA/IAA) threaded IRQ handler, reached only by local kernel-mode descriptor submission (dmaengine clients, or iaa_crypto backing zswap/zram); no remote or adjacent-network data path feeds `irq_entry-\u003ework_list`.\nAC:L - The attacker drives one side of the race directly \u2014 sustained parallel descriptor submission (and ENQCMDS-busy abort handling on a shared WQ) from other CPUs repeatedly re-allocates and re-links the just-freed descriptor while the IRQ thread is still walking `flist` \u2014 so the window can be hit reliably by volume rather than by luck.\nPR:L - On an IAA/DSA-accelerated system an ordinary unprivileged process reaches this path with no capability check by generating compression/DMA offload traffic (e.g. memory pressure driving zswap through iaa_crypto with interrupt completion); no root or CAP_SYS_ADMIN is needed.\nUI:N - The race is triggered entirely by the attacker\u0027s own workload inside the interrupt-completion path; no victim action such as mounting, opening a file, or loading a module is required.\nS:U - The corruption is confined to kernel memory and kernel-managed DMA descriptors within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - Following the stale `-\u003elist` pointer causes the handler to prematurely complete descriptors still owned by other contexts, so DMA source/destination buffers and completion records belonging to unrelated kernel consumers (e.g. other tasks\u0027 zswap pages) are read and released to the wrong owner, and the reused-descriptor UAF gives an attacker-influenced read primitive.\nI:H - A descriptor can be released twice into the sbitmap so two contexts own the same descriptor and DMA target, letting the device write results into buffers already handed back, and the list-pointer corruption modifies kernel list structures \u2014 a use-after-free of this kind is leveragable for controlled kernel memory modification.\nA:H - Iterating into a foreign list and double-releasing descriptors produces the same list corruption / general protection fault seen in the parent commit\u0027s splat (`irq_process_work_list+0xcd`), i.e. a kernel oops or panic in an IRQ thread, and it can be retriggered."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:34:15.229Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/1b08bf5a17c66ab7dbb628df5344da53c8e7ab33"
        },
        {
          "url": "https://git.kernel.org/stable/c/83163667d881100a485b6c2daa30301b7f68d9b5"
        },
        {
          "url": "https://git.kernel.org/stable/c/faa35db78b058a2ab6e074ee283f69fa398c36a8"
        },
        {
          "url": "https://git.kernel.org/stable/c/a14968921486793f2a956086895c3793761309dd"
        },
        {
          "url": "https://git.kernel.org/stable/c/e3215deca4520773cd2b155bed164c12365149a7"
        }
      ],
      "title": "dmaengine: idxd: Fix possible Use-After-Free in irq_process_work_list",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-40956",
    "datePublished": "2024-07-12T12:31:59.027Z",
    "dateReserved": "2024-07-12T12:17:45.593Z",
    "dateUpdated": "2026-08-05T11:34:15.229Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-40956",
      "date": "2026-08-07",
      "epss": "0.00268",
      "percentile": "0.18707"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-40956\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-07-12T13:15:17.760\",\"lastModified\":\"2026-06-17T07:46:57.080\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndmaengine: idxd: Fix possible Use-After-Free in irq_process_work_list\\n\\nUse list_for_each_entry_safe() to allow iterating through the list and\\ndeleting the entry in the iteration process. The descriptor is freed via\\nidxd_desc_complete() and there\u0027s a slight chance may cause issue for\\nthe list iterator when the descriptor is reused by another thread\\nwithout it being deleted from the list.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: dmaengine: idxd: corrija posible Use-After-Free en irq_process_work_list Use list_for_each_entry_safe() para permitir iterar a trav\u00e9s de la lista y eliminar la entrada en el proceso de iteraci\u00f3n. El descriptor se libera a trav\u00e9s de idxd_desc_complete() y existe una peque\u00f1a posibilidad de que cause problemas para el iterador de la lista cuando otro subproceso reutiliza el descriptor sin que se elimine de la lista.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/dma/idxd/irq.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"16e19e11228ba660d9e322035635e7dcf160d5c2\",\"lessThan\":\"1b08bf5a17c66ab7dbb628df5344da53c8e7ab33\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"16e19e11228ba660d9e322035635e7dcf160d5c2\",\"lessThan\":\"83163667d881100a485b6c2daa30301b7f68d9b5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"16e19e11228ba660d9e322035635e7dcf160d5c2\",\"lessThan\":\"faa35db78b058a2ab6e074ee283f69fa398c36a8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"16e19e11228ba660d9e322035635e7dcf160d5c2\",\"lessThan\":\"a14968921486793f2a956086895c3793761309dd\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"16e19e11228ba660d9e322035635e7dcf160d5c2\",\"lessThan\":\"e3215deca4520773cd2b155bed164c12365149a7\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/dma/idxd/irq.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.11\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.11\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.162\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.96\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.36\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.9.7\",\"lessThanOrEqual\":\"6.9.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-10T17:03:42.094021Z\",\"id\":\"CVE-2024-40956\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.162\",\"matchCriteriaId\":\"10A39ACC-3005-40E8-875C-98A372D1FFD5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.96\",\"matchCriteriaId\":\"61E887B4-732A-40D2-9983-CC6F281EBFB7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.36\",\"matchCriteriaId\":\"E1046C95-860A-45B0-B718-2B29F65BFF10\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.9.7\",\"matchCriteriaId\":\"0A047AF2-94AC-4A3A-B32D-6AB930D8EF1C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.10:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"2EBB4392-5FA6-4DA9-9772-8F9C750109FA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.10:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"331C2F14-12C7-45D5-893D-8C52EE38EA10\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.10:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"3173713D-909A-4DD3-9DD4-1E171EB057EE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.10:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"79F18AFA-40F7-43F0-BA30-7BDB65F918B9\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1b08bf5a17c66ab7dbb628df5344da53c8e7ab33\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/83163667d881100a485b6c2daa30301b7f68d9b5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a14968921486793f2a956086895c3793761309dd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e3215deca4520773cd2b155bed164c12365149a7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/faa35db78b058a2ab6e074ee283f69fa398c36a8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/1b08bf5a17c66ab7dbb628df5344da53c8e7ab33\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/83163667d881100a485b6c2daa30301b7f68d9b5\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a14968921486793f2a956086895c3793761309dd\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e3215deca4520773cd2b155bed164c12365149a7\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/faa35db78b058a2ab6e074ee283f69fa398c36a8\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T18:37:26+00:00",
      "cve": "CVE-2024-40956",
      "id": "CVE-2024-40956",
      "initial_release_date": "2024-07-12T00:00:00+00:00",
      "product_status:fixed": "818",
      "product_status:known_affected": "70",
      "product_status:known_not_affected": "43",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: dmaengine: idxd: Fix possible Use-After-Free in irq_process_work_list",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-40956.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/1b08bf5a17c66ab7dbb628df5344da53c8e7ab33\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/83163667d881100a485b6c2daa30301b7f68d9b5\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/faa35db78b058a2ab6e074ee283f69fa398c36a8\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/a14968921486793f2a956086895c3793761309dd\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/e3215deca4520773cd2b155bed164c12365149a7\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T21:58:20.070Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-40956\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T17:03:42.094021Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:22.434Z\"}}], \"cna\": {\"title\": \"dmaengine: idxd: Fix possible Use-After-Free in irq_process_work_list\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The vulnerable code is the idxd (Intel DSA/IAA) threaded IRQ handler, reached only by local kernel-mode descriptor submission (dmaengine clients, or iaa_crypto backing zswap/zram); no remote or adjacent-network data path feeds `irq_entry-\u003ework_list`.\\nAC:L - The attacker drives one side of the race directly \\u2014 sustained parallel descriptor submission (and ENQCMDS-busy abort handling on a shared WQ) from other CPUs repeatedly re-allocates and re-links the just-freed descriptor while the IRQ thread is still walking `flist` \\u2014 so the window can be hit reliably by volume rather than by luck.\\nPR:L - On an IAA/DSA-accelerated system an ordinary unprivileged process reaches this path with no capability check by generating compression/DMA offload traffic (e.g. memory pressure driving zswap through iaa_crypto with interrupt completion); no root or CAP_SYS_ADMIN is needed.\\nUI:N - The race is triggered entirely by the attacker\u0027s own workload inside the interrupt-completion path; no victim action such as mounting, opening a file, or loading a module is required.\\nS:U - The corruption is confined to kernel memory and kernel-managed DMA descriptors within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\\nC:H - Following the stale `-\u003elist` pointer causes the handler to prematurely complete descriptors still owned by other contexts, so DMA source/destination buffers and completion records belonging to unrelated kernel consumers (e.g. other tasks\u0027 zswap pages) are read and released to the wrong owner, and the reused-descriptor UAF gives an attacker-influenced read primitive.\\nI:H - A descriptor can be released twice into the sbitmap so two contexts own the same descriptor and DMA target, letting the device write results into buffers already handed back, and the list-pointer corruption modifies kernel list structures \\u2014 a use-after-free of this kind is leveragable for controlled kernel memory modification.\\nA:H - Iterating into a foreign list and double-releasing descriptors produces the same list corruption / general protection fault seen in the parent commit\u0027s splat (`irq_process_work_list+0xcd`), i.e. a kernel oops or panic in an IRQ thread, and it can be retriggered.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"16e19e11228ba660d9e322035635e7dcf160d5c2\", \"lessThan\": \"1b08bf5a17c66ab7dbb628df5344da53c8e7ab33\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"16e19e11228ba660d9e322035635e7dcf160d5c2\", \"lessThan\": \"83163667d881100a485b6c2daa30301b7f68d9b5\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"16e19e11228ba660d9e322035635e7dcf160d5c2\", \"lessThan\": \"faa35db78b058a2ab6e074ee283f69fa398c36a8\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"16e19e11228ba660d9e322035635e7dcf160d5c2\", \"lessThan\": \"a14968921486793f2a956086895c3793761309dd\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"16e19e11228ba660d9e322035635e7dcf160d5c2\", \"lessThan\": \"e3215deca4520773cd2b155bed164c12365149a7\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/dma/idxd/irq.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.11\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.11\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.15.162\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.96\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.36\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9.7\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.9.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/dma/idxd/irq.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/1b08bf5a17c66ab7dbb628df5344da53c8e7ab33\"}, {\"url\": \"https://git.kernel.org/stable/c/83163667d881100a485b6c2daa30301b7f68d9b5\"}, {\"url\": \"https://git.kernel.org/stable/c/faa35db78b058a2ab6e074ee283f69fa398c36a8\"}, {\"url\": \"https://git.kernel.org/stable/c/a14968921486793f2a956086895c3793761309dd\"}, {\"url\": \"https://git.kernel.org/stable/c/e3215deca4520773cd2b155bed164c12365149a7\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndmaengine: idxd: Fix possible Use-After-Free in irq_process_work_list\\n\\nUse list_for_each_entry_safe() to allow iterating through the list and\\ndeleting the entry in the iteration process. The descriptor is freed via\\nidxd_desc_complete() and there\u0027s a slight chance may cause issue for\\nthe list iterator when the descriptor is reused by another thread\\nwithout it being deleted from the list.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.162\", \"versionStartIncluding\": \"5.11\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.96\", \"versionStartIncluding\": \"5.11\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.36\", \"versionStartIncluding\": \"5.11\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9.7\", \"versionStartIncluding\": \"5.11\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10\", \"versionStartIncluding\": \"5.11\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:34:15.229Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-40956\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:34:15.229Z\", \"dateReserved\": \"2024-07-12T12:17:45.593Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-07-12T12:31:59.027Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.