GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-40906 (GCVE-0-2024-40906)

Vulnerability from cvelistv5 – Published: 2024-07-12 12:20 – Updated: 2026-05-11 20:22
VLAI
Title
net/mlx5: Always stop health timer during driver removal
Summary
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Always stop health timer during driver removal Currently, if teardown_hca fails to execute during driver removal, mlx5 does not stop the health timer. Afterwards, mlx5 continue with driver teardown. This may lead to a UAF bug, which results in page fault Oops[1], since the health timer invokes after resources were freed. Hence, stop the health monitor even if teardown_hca fails. [1] mlx5_core 0000:18:00.0: E-Switch: Unload vfs: mode(LEGACY), nvfs(0), necvfs(0), active vports(0) mlx5_core 0000:18:00.0: E-Switch: Disable: mode(LEGACY), nvfs(0), necvfs(0), active vports(0) mlx5_core 0000:18:00.0: E-Switch: Disable: mode(LEGACY), nvfs(0), necvfs(0), active vports(0) mlx5_core 0000:18:00.0: E-Switch: cleanup mlx5_core 0000:18:00.0: wait_func:1155:(pid 1967079): TEARDOWN_HCA(0x103) timeout. Will cause a leak of a command resource mlx5_core 0000:18:00.0: mlx5_function_close:1288:(pid 1967079): tear_down_hca failed, skip cleanup BUG: unable to handle page fault for address: ffffa26487064230 PGD 100c00067 P4D 100c00067 PUD 100e5a067 PMD 105ed7067 PTE 0 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 0 PID: 0 Comm: swapper/0 Tainted: G OE ------- --- 6.7.0-68.fc38.x86_64 #1 Hardware name: Intel Corporation S2600WFT/S2600WFT, BIOS SE5C620.86B.02.01.0013.121520200651 12/15/2020 RIP: 0010:ioread32be+0x34/0x60 RSP: 0018:ffffa26480003e58 EFLAGS: 00010292 RAX: ffffa26487064200 RBX: ffff9042d08161a0 RCX: ffff904c108222c0 RDX: 000000010bbf1b80 RSI: ffffffffc055ddb0 RDI: ffffa26487064230 RBP: ffff9042d08161a0 R08: 0000000000000022 R09: ffff904c108222e8 R10: 0000000000000004 R11: 0000000000000441 R12: ffffffffc055ddb0 R13: ffffa26487064200 R14: ffffa26480003f00 R15: ffff904c108222c0 FS: 0000000000000000(0000) GS:ffff904c10800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffa26487064230 CR3: 00000002c4420006 CR4: 00000000007706f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <IRQ> ? __die+0x23/0x70 ? page_fault_oops+0x171/0x4e0 ? exc_page_fault+0x175/0x180 ? asm_exc_page_fault+0x26/0x30 ? __pfx_poll_health+0x10/0x10 [mlx5_core] ? __pfx_poll_health+0x10/0x10 [mlx5_core] ? ioread32be+0x34/0x60 mlx5_health_check_fatal_sensors+0x20/0x100 [mlx5_core] ? __pfx_poll_health+0x10/0x10 [mlx5_core] poll_health+0x42/0x230 [mlx5_core] ? __next_timer_interrupt+0xbc/0x110 ? __pfx_poll_health+0x10/0x10 [mlx5_core] call_timer_fn+0x21/0x130 ? __pfx_poll_health+0x10/0x10 [mlx5_core] __run_timers+0x222/0x2c0 run_timer_softirq+0x1d/0x40 __do_softirq+0xc9/0x2c8 __irq_exit_rcu+0xa6/0xc0 sysvec_apic_timer_interrupt+0x72/0x90 </IRQ> <TASK> asm_sysvec_apic_timer_interrupt+0x1a/0x20 RIP: 0010:cpuidle_enter_state+0xcc/0x440 ? cpuidle_enter_state+0xbd/0x440 cpuidle_enter+0x2d/0x40 do_idle+0x20d/0x270 cpu_startup_entry+0x2a/0x30 rest_init+0xd0/0xd0 arch_call_rest_init+0xe/0x30 start_kernel+0x709/0xa90 x86_64_start_reservations+0x18/0x30 x86_64_start_kernel+0x96/0xa0 secondary_startup_64_no_verify+0x18f/0x19b ---[ end trace 0000000000000000 ]---
Severity
No CVSS data available.
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-10 17:06 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 9b98d395b85dd042fe83fb696b1ac02e6c93a520 , < e7d4485d47839f4d1284592ae242c4e65b2810a9 (git)
Affected: 9b98d395b85dd042fe83fb696b1ac02e6c93a520 , < 6ccada6ffb42e0ac75e3db06d41baf5a7f483f8a (git)
Affected: 9b98d395b85dd042fe83fb696b1ac02e6c93a520 , < e6777ae0bf6fd5bc626bb051c8c93e3c8198a3f8 (git)
Affected: 9b98d395b85dd042fe83fb696b1ac02e6c93a520 , < c8b3f38d2dae0397944814d691a419c451f9906f (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.1
Unaffected: 0 , < 6.1 (semver)
Unaffected: 6.1.95 , ≤ 6.1.* (semver)
Unaffected: 6.6.35 , ≤ 6.6.* (semver)
Unaffected: 6.9.6 , ≤ 6.9.* (semver)
Unaffected: 6.10 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T21:57:36.228Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e7d4485d47839f4d1284592ae242c4e65b2810a9"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/6ccada6ffb42e0ac75e3db06d41baf5a7f483f8a"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e6777ae0bf6fd5bc626bb051c8c93e3c8198a3f8"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/c8b3f38d2dae0397944814d691a419c451f9906f"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-40906",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T17:06:18.717669Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:34:38.096Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mellanox/mlx5/core/main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e7d4485d47839f4d1284592ae242c4e65b2810a9",
              "status": "affected",
              "version": "9b98d395b85dd042fe83fb696b1ac02e6c93a520",
              "versionType": "git"
            },
            {
              "lessThan": "6ccada6ffb42e0ac75e3db06d41baf5a7f483f8a",
              "status": "affected",
              "version": "9b98d395b85dd042fe83fb696b1ac02e6c93a520",
              "versionType": "git"
            },
            {
              "lessThan": "e6777ae0bf6fd5bc626bb051c8c93e3c8198a3f8",
              "status": "affected",
              "version": "9b98d395b85dd042fe83fb696b1ac02e6c93a520",
              "versionType": "git"
            },
            {
              "lessThan": "c8b3f38d2dae0397944814d691a419c451f9906f",
              "status": "affected",
              "version": "9b98d395b85dd042fe83fb696b1ac02e6c93a520",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mellanox/mlx5/core/main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.1"
            },
            {
              "lessThan": "6.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.95",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.10",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.95",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.35",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9.6",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: Always stop health timer during driver removal\n\nCurrently, if teardown_hca fails to execute during driver removal, mlx5\ndoes not stop the health timer. Afterwards, mlx5 continue with driver\nteardown. This may lead to a UAF bug, which results in page fault\nOops[1], since the health timer invokes after resources were freed.\n\nHence, stop the health monitor even if teardown_hca fails.\n\n[1]\nmlx5_core 0000:18:00.0: E-Switch: Unload vfs: mode(LEGACY), nvfs(0), necvfs(0), active vports(0)\nmlx5_core 0000:18:00.0: E-Switch: Disable: mode(LEGACY), nvfs(0), necvfs(0), active vports(0)\nmlx5_core 0000:18:00.0: E-Switch: Disable: mode(LEGACY), nvfs(0), necvfs(0), active vports(0)\nmlx5_core 0000:18:00.0: E-Switch: cleanup\nmlx5_core 0000:18:00.0: wait_func:1155:(pid 1967079): TEARDOWN_HCA(0x103) timeout. Will cause a leak of a command resource\nmlx5_core 0000:18:00.0: mlx5_function_close:1288:(pid 1967079): tear_down_hca failed, skip cleanup\nBUG: unable to handle page fault for address: ffffa26487064230\nPGD 100c00067 P4D 100c00067 PUD 100e5a067 PMD 105ed7067 PTE 0\nOops: 0000 [#1] PREEMPT SMP PTI\nCPU: 0 PID: 0 Comm: swapper/0 Tainted: G           OE     -------  ---  6.7.0-68.fc38.x86_64 #1\nHardware name: Intel Corporation S2600WFT/S2600WFT, BIOS SE5C620.86B.02.01.0013.121520200651 12/15/2020\nRIP: 0010:ioread32be+0x34/0x60\nRSP: 0018:ffffa26480003e58 EFLAGS: 00010292\nRAX: ffffa26487064200 RBX: ffff9042d08161a0 RCX: ffff904c108222c0\nRDX: 000000010bbf1b80 RSI: ffffffffc055ddb0 RDI: ffffa26487064230\nRBP: ffff9042d08161a0 R08: 0000000000000022 R09: ffff904c108222e8\nR10: 0000000000000004 R11: 0000000000000441 R12: ffffffffc055ddb0\nR13: ffffa26487064200 R14: ffffa26480003f00 R15: ffff904c108222c0\nFS:  0000000000000000(0000) GS:ffff904c10800000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: ffffa26487064230 CR3: 00000002c4420006 CR4: 00000000007706f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nPKRU: 55555554\nCall Trace:\n \u003cIRQ\u003e\n ? __die+0x23/0x70\n ? page_fault_oops+0x171/0x4e0\n ? exc_page_fault+0x175/0x180\n ? asm_exc_page_fault+0x26/0x30\n ? __pfx_poll_health+0x10/0x10 [mlx5_core]\n ? __pfx_poll_health+0x10/0x10 [mlx5_core]\n ? ioread32be+0x34/0x60\n mlx5_health_check_fatal_sensors+0x20/0x100 [mlx5_core]\n ? __pfx_poll_health+0x10/0x10 [mlx5_core]\n poll_health+0x42/0x230 [mlx5_core]\n ? __next_timer_interrupt+0xbc/0x110\n ? __pfx_poll_health+0x10/0x10 [mlx5_core]\n call_timer_fn+0x21/0x130\n ? __pfx_poll_health+0x10/0x10 [mlx5_core]\n __run_timers+0x222/0x2c0\n run_timer_softirq+0x1d/0x40\n __do_softirq+0xc9/0x2c8\n __irq_exit_rcu+0xa6/0xc0\n sysvec_apic_timer_interrupt+0x72/0x90\n \u003c/IRQ\u003e\n \u003cTASK\u003e\n asm_sysvec_apic_timer_interrupt+0x1a/0x20\nRIP: 0010:cpuidle_enter_state+0xcc/0x440\n ? cpuidle_enter_state+0xbd/0x440\n cpuidle_enter+0x2d/0x40\n do_idle+0x20d/0x270\n cpu_startup_entry+0x2a/0x30\n rest_init+0xd0/0xd0\n arch_call_rest_init+0xe/0x30\n start_kernel+0x709/0xa90\n x86_64_start_reservations+0x18/0x30\n x86_64_start_kernel+0x96/0xa0\n secondary_startup_64_no_verify+0x18f/0x19b\n---[ end trace 0000000000000000 ]---"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T20:22:06.884Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e7d4485d47839f4d1284592ae242c4e65b2810a9"
        },
        {
          "url": "https://git.kernel.org/stable/c/6ccada6ffb42e0ac75e3db06d41baf5a7f483f8a"
        },
        {
          "url": "https://git.kernel.org/stable/c/e6777ae0bf6fd5bc626bb051c8c93e3c8198a3f8"
        },
        {
          "url": "https://git.kernel.org/stable/c/c8b3f38d2dae0397944814d691a419c451f9906f"
        }
      ],
      "title": "net/mlx5: Always stop health timer during driver removal",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-40906",
    "datePublished": "2024-07-12T12:20:46.485Z",
    "dateReserved": "2024-07-12T12:17:45.580Z",
    "dateUpdated": "2026-05-11T20:22:06.884Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-40906",
      "date": "2026-09-15",
      "epss": "0.00305",
      "percentile": "0.23093"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.1\", \"versionEndExcluding\": \"6.1.95\", \"matchCriteriaId\": \"FD98DE98-9D47-474B-A2EF-433D10E7459C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.2\", \"versionEndExcluding\": \"6.6.35\", \"matchCriteriaId\": \"6F019D15-84C0-416B-8C57-7F51B68992F0\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.7\", \"versionEndExcluding\": \"6.9.6\", \"matchCriteriaId\": \"0ABBBA1D-F79D-4BDB-AA41-D1EDCC4A6975\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.10:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"2EBB4392-5FA6-4DA9-9772-8F9C750109FA\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.10:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"331C2F14-12C7-45D5-893D-8C52EE38EA10\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet/mlx5: Always stop health timer during driver removal\\n\\nCurrently, if teardown_hca fails to execute during driver removal, mlx5\\ndoes not stop the health timer. Afterwards, mlx5 continue with driver\\nteardown. This may lead to a UAF bug, which results in page fault\\nOops[1], since the health timer invokes after resources were freed.\\n\\nHence, stop the health monitor even if teardown_hca fails.\\n\\n[1]\\nmlx5_core 0000:18:00.0: E-Switch: Unload vfs: mode(LEGACY), nvfs(0), necvfs(0), active vports(0)\\nmlx5_core 0000:18:00.0: E-Switch: Disable: mode(LEGACY), nvfs(0), necvfs(0), active vports(0)\\nmlx5_core 0000:18:00.0: E-Switch: Disable: mode(LEGACY), nvfs(0), necvfs(0), active vports(0)\\nmlx5_core 0000:18:00.0: E-Switch: cleanup\\nmlx5_core 0000:18:00.0: wait_func:1155:(pid 1967079): TEARDOWN_HCA(0x103) timeout. Will cause a leak of a command resource\\nmlx5_core 0000:18:00.0: mlx5_function_close:1288:(pid 1967079): tear_down_hca failed, skip cleanup\\nBUG: unable to handle page fault for address: ffffa26487064230\\nPGD 100c00067 P4D 100c00067 PUD 100e5a067 PMD 105ed7067 PTE 0\\nOops: 0000 [#1] PREEMPT SMP PTI\\nCPU: 0 PID: 0 Comm: swapper/0 Tainted: G           OE     -------  ---  6.7.0-68.fc38.x86_64 #1\\nHardware name: Intel Corporation S2600WFT/S2600WFT, BIOS SE5C620.86B.02.01.0013.121520200651 12/15/2020\\nRIP: 0010:ioread32be+0x34/0x60\\nRSP: 0018:ffffa26480003e58 EFLAGS: 00010292\\nRAX: ffffa26487064200 RBX: ffff9042d08161a0 RCX: ffff904c108222c0\\nRDX: 000000010bbf1b80 RSI: ffffffffc055ddb0 RDI: ffffa26487064230\\nRBP: ffff9042d08161a0 R08: 0000000000000022 R09: ffff904c108222e8\\nR10: 0000000000000004 R11: 0000000000000441 R12: ffffffffc055ddb0\\nR13: ffffa26487064200 R14: ffffa26480003f00 R15: ffff904c108222c0\\nFS:  0000000000000000(0000) GS:ffff904c10800000(0000) knlGS:0000000000000000\\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\nCR2: ffffa26487064230 CR3: 00000002c4420006 CR4: 00000000007706f0\\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\\nPKRU: 55555554\\nCall Trace:\\n \u003cIRQ\u003e\\n ? __die+0x23/0x70\\n ? page_fault_oops+0x171/0x4e0\\n ? exc_page_fault+0x175/0x180\\n ? asm_exc_page_fault+0x26/0x30\\n ? __pfx_poll_health+0x10/0x10 [mlx5_core]\\n ? __pfx_poll_health+0x10/0x10 [mlx5_core]\\n ? ioread32be+0x34/0x60\\n mlx5_health_check_fatal_sensors+0x20/0x100 [mlx5_core]\\n ? __pfx_poll_health+0x10/0x10 [mlx5_core]\\n poll_health+0x42/0x230 [mlx5_core]\\n ? __next_timer_interrupt+0xbc/0x110\\n ? __pfx_poll_health+0x10/0x10 [mlx5_core]\\n call_timer_fn+0x21/0x130\\n ? __pfx_poll_health+0x10/0x10 [mlx5_core]\\n __run_timers+0x222/0x2c0\\n run_timer_softirq+0x1d/0x40\\n __do_softirq+0xc9/0x2c8\\n __irq_exit_rcu+0xa6/0xc0\\n sysvec_apic_timer_interrupt+0x72/0x90\\n \u003c/IRQ\u003e\\n \u003cTASK\u003e\\n asm_sysvec_apic_timer_interrupt+0x1a/0x20\\nRIP: 0010:cpuidle_enter_state+0xcc/0x440\\n ? cpuidle_enter_state+0xbd/0x440\\n cpuidle_enter+0x2d/0x40\\n do_idle+0x20d/0x270\\n cpu_startup_entry+0x2a/0x30\\n rest_init+0xd0/0xd0\\n arch_call_rest_init+0xe/0x30\\n start_kernel+0x709/0xa90\\n x86_64_start_reservations+0x18/0x30\\n x86_64_start_kernel+0x96/0xa0\\n secondary_startup_64_no_verify+0x18f/0x19b\\n---[ end trace 0000000000000000 ]---\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se resolvi\\u00f3 la siguiente vulnerabilidad: net/mlx5: detener siempre el temporizador de estado durante la eliminaci\\u00f3n del controlador. Actualmente, si teardown_hca no se ejecuta durante la eliminaci\\u00f3n del controlador, mlx5 no detiene el temporizador de estado. Posteriormente, mlx5 contin\\u00faa con el desmontaje del controlador. Esto puede provocar un error de UAF, lo que resulta en un error de p\\u00e1gina Ups[1], ya que el temporizador de estado se invoca despu\\u00e9s de que se liberaron los recursos. Por lo tanto, detenga el monitor de salud incluso si falla Teardown_hca. [1] mlx5_core 0000:18:00.0: E-Switch: Descargar vfs: modo(LEGACY), nvfs(0), necvfs(0), vports activos(0) mlx5_core 0000:18:00.0: E-Switch: Deshabilitar: mode(LEGACY), nvfs(0), necvfs(0), active vports(0) mlx5_core 0000:18:00.0: E-Switch: Desactivar: mode(LEGACY), nvfs(0), necvfs(0), active vports (0) mlx5_core 0000:18:00.0: E-Switch: limpieza mlx5_core 0000:18:00.0: wait_func:1155:(pid 1967079): TEARDOWN_HCA(0x103) tiempo de espera. Provocar\\u00e1 una fuga de un recurso de comando mlx5_core 0000:18:00.0: mlx5_function_close:1288:(pid 1967079): fall\\u00f3 el desmontaje_hca, omiti\\u00f3 la limpieza ERROR: no se puede manejar el error de p\\u00e1gina para la direcci\\u00f3n: ffffa26487064230 PGD 100c00067 P4D 100c00067 PUD 67 PMD 105ed7067 PTE 0 Vaya: 0000 [#1] PREEMPT SMP PTI CPU: 0 PID: 0 Comunicaciones: intercambiador/0 Contaminado: G OE ------- --- 6.7.0-68.fc38.x86_64 #1 Nombre de hardware: Intel Corporaci\\u00f3n S2600WFT/S2600WFT, BIOS SE5C620.86B.02.01.0013.121520200651 15/12/2020 RIP: 0010:ioread32be+0x34/0x60 RSP: 0018:ffffa26480003e58 EFLAGS: 2 RAX: ffffa26487064200 RBX: ffff9042d08161a0 RCX: ffff904c108222c0 RDX: 000000010bbf1b80 RSI: ffffffffc055ddb0 RDI: ffffa26487064230 RBP: ffff9042d08161a0 R08: 0000000000000022 R09: ffff904c108222e8 R10: 00000000000000004 R11: 0000000000000441 R12: ffffffc055ddb0 R13: ffffa26487064200 R14: ffffa26480003f00 R15: ffff904c108222c0 FS: 0000000000000000(0000) GS:ffff904c10800000(0000) 0000000000CS: 0010DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffa26487064230 CR3: 00000002c4420006 CR4: 00000000007706f0 DR0: 0000000000000000 DR1: 0000000000 000000 DR2: 0000000000000000 DR3: 00000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Seguimiento de llamadas:  ? __morir+0x23/0x70 ? page_fault_oops+0x171/0x4e0? exc_page_fault+0x175/0x180? asm_exc_page_fault+0x26/0x30? __pfx_poll_health+0x10/0x10 [mlx5_core] ? __pfx_poll_health+0x10/0x10 [mlx5_core] ? ioread32be+0x34/0x60 mlx5_health_check_fatal_sensors+0x20/0x100 [mlx5_core] ? __pfx_poll_health+0x10/0x10 [mlx5_core] poll_health+0x42/0x230 [mlx5_core] ? __next_timer_interrupt+0xbc/0x110? __pfx_poll_health+0x10/0x10 [mlx5_core] call_timer_fn+0x21/0x130? __pfx_poll_health+0x10/0x10 [mlx5_core] __run_timers+0x222/0x2c0 run_timer_softirq+0x1d/0x40 __do_softirq+0xc9/0x2c8 __irq_exit_rcu+0xa6/0xc0 sysvec_apic_timer_interrupt+0x72/0x90   asm_sysvec_apic_timer_interrupt+0x1a/0x20 RIP: 0010:cpuidle_enter_state +0xcc/0x440 ? cpuidle_enter_state+0xbd/0x440 cpuidle_enter+0x2d/0x40 do_idle+0x20d/0x270 cpu_startup_entry+0x2a/0x30 rest_init+0xd0/0xd0 arch_call_rest_init+0xe/0x30 start_kernel+0x709/0xa90 x86_64_start _reservations+0x18/0x30 x86_64_start_kernel+0x96/0xa0 second_startup_64_no_verify+0x18f/0x19b ---[ final de seguimiento 0000000000000000 ]---\"}]",
      "id": "CVE-2024-40906",
      "lastModified": "2024-11-21T09:31:49.920",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 5.9}]}",
      "published": "2024-07-12T13:15:13.920",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/6ccada6ffb42e0ac75e3db06d41baf5a7f483f8a\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/c8b3f38d2dae0397944814d691a419c451f9906f\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/e6777ae0bf6fd5bc626bb051c8c93e3c8198a3f8\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/e7d4485d47839f4d1284592ae242c4e65b2810a9\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/6ccada6ffb42e0ac75e3db06d41baf5a7f483f8a\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/c8b3f38d2dae0397944814d691a419c451f9906f\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/e6777ae0bf6fd5bc626bb051c8c93e3c8198a3f8\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/e7d4485d47839f4d1284592ae242c4e65b2810a9\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-416\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-40906\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-07-12T13:15:13.920\",\"lastModified\":\"2026-06-17T07:46:50.340\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet/mlx5: Always stop health timer during driver removal\\n\\nCurrently, if teardown_hca fails to execute during driver removal, mlx5\\ndoes not stop the health timer. Afterwards, mlx5 continue with driver\\nteardown. This may lead to a UAF bug, which results in page fault\\nOops[1], since the health timer invokes after resources were freed.\\n\\nHence, stop the health monitor even if teardown_hca fails.\\n\\n[1]\\nmlx5_core 0000:18:00.0: E-Switch: Unload vfs: mode(LEGACY), nvfs(0), necvfs(0), active vports(0)\\nmlx5_core 0000:18:00.0: E-Switch: Disable: mode(LEGACY), nvfs(0), necvfs(0), active vports(0)\\nmlx5_core 0000:18:00.0: E-Switch: Disable: mode(LEGACY), nvfs(0), necvfs(0), active vports(0)\\nmlx5_core 0000:18:00.0: E-Switch: cleanup\\nmlx5_core 0000:18:00.0: wait_func:1155:(pid 1967079): TEARDOWN_HCA(0x103) timeout. Will cause a leak of a command resource\\nmlx5_core 0000:18:00.0: mlx5_function_close:1288:(pid 1967079): tear_down_hca failed, skip cleanup\\nBUG: unable to handle page fault for address: ffffa26487064230\\nPGD 100c00067 P4D 100c00067 PUD 100e5a067 PMD 105ed7067 PTE 0\\nOops: 0000 [#1] PREEMPT SMP PTI\\nCPU: 0 PID: 0 Comm: swapper/0 Tainted: G           OE     -------  ---  6.7.0-68.fc38.x86_64 #1\\nHardware name: Intel Corporation S2600WFT/S2600WFT, BIOS SE5C620.86B.02.01.0013.121520200651 12/15/2020\\nRIP: 0010:ioread32be+0x34/0x60\\nRSP: 0018:ffffa26480003e58 EFLAGS: 00010292\\nRAX: ffffa26487064200 RBX: ffff9042d08161a0 RCX: ffff904c108222c0\\nRDX: 000000010bbf1b80 RSI: ffffffffc055ddb0 RDI: ffffa26487064230\\nRBP: ffff9042d08161a0 R08: 0000000000000022 R09: ffff904c108222e8\\nR10: 0000000000000004 R11: 0000000000000441 R12: ffffffffc055ddb0\\nR13: ffffa26487064200 R14: ffffa26480003f00 R15: ffff904c108222c0\\nFS:  0000000000000000(0000) GS:ffff904c10800000(0000) knlGS:0000000000000000\\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\nCR2: ffffa26487064230 CR3: 00000002c4420006 CR4: 00000000007706f0\\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\\nPKRU: 55555554\\nCall Trace:\\n \u003cIRQ\u003e\\n ? __die+0x23/0x70\\n ? page_fault_oops+0x171/0x4e0\\n ? exc_page_fault+0x175/0x180\\n ? asm_exc_page_fault+0x26/0x30\\n ? __pfx_poll_health+0x10/0x10 [mlx5_core]\\n ? __pfx_poll_health+0x10/0x10 [mlx5_core]\\n ? ioread32be+0x34/0x60\\n mlx5_health_check_fatal_sensors+0x20/0x100 [mlx5_core]\\n ? __pfx_poll_health+0x10/0x10 [mlx5_core]\\n poll_health+0x42/0x230 [mlx5_core]\\n ? __next_timer_interrupt+0xbc/0x110\\n ? __pfx_poll_health+0x10/0x10 [mlx5_core]\\n call_timer_fn+0x21/0x130\\n ? __pfx_poll_health+0x10/0x10 [mlx5_core]\\n __run_timers+0x222/0x2c0\\n run_timer_softirq+0x1d/0x40\\n __do_softirq+0xc9/0x2c8\\n __irq_exit_rcu+0xa6/0xc0\\n sysvec_apic_timer_interrupt+0x72/0x90\\n \u003c/IRQ\u003e\\n \u003cTASK\u003e\\n asm_sysvec_apic_timer_interrupt+0x1a/0x20\\nRIP: 0010:cpuidle_enter_state+0xcc/0x440\\n ? cpuidle_enter_state+0xbd/0x440\\n cpuidle_enter+0x2d/0x40\\n do_idle+0x20d/0x270\\n cpu_startup_entry+0x2a/0x30\\n rest_init+0xd0/0xd0\\n arch_call_rest_init+0xe/0x30\\n start_kernel+0x709/0xa90\\n x86_64_start_reservations+0x18/0x30\\n x86_64_start_kernel+0x96/0xa0\\n secondary_startup_64_no_verify+0x18f/0x19b\\n---[ end trace 0000000000000000 ]---\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: net/mlx5: detener siempre el temporizador de estado durante la eliminaci\u00f3n del controlador. Actualmente, si teardown_hca no se ejecuta durante la eliminaci\u00f3n del controlador, mlx5 no detiene el temporizador de estado. Posteriormente, mlx5 contin\u00faa con el desmontaje del controlador. Esto puede provocar un error de UAF, lo que resulta en un error de p\u00e1gina Ups[1], ya que el temporizador de estado se invoca despu\u00e9s de que se liberaron los recursos. Por lo tanto, detenga el monitor de salud incluso si falla Teardown_hca. [1] mlx5_core 0000:18:00.0: E-Switch: Descargar vfs: modo(LEGACY), nvfs(0), necvfs(0), vports activos(0) mlx5_core 0000:18:00.0: E-Switch: Deshabilitar: mode(LEGACY), nvfs(0), necvfs(0), active vports(0) mlx5_core 0000:18:00.0: E-Switch: Desactivar: mode(LEGACY), nvfs(0), necvfs(0), active vports (0) mlx5_core 0000:18:00.0: E-Switch: limpieza mlx5_core 0000:18:00.0: wait_func:1155:(pid 1967079): TEARDOWN_HCA(0x103) tiempo de espera. Provocar\u00e1 una fuga de un recurso de comando mlx5_core 0000:18:00.0: mlx5_function_close:1288:(pid 1967079): fall\u00f3 el desmontaje_hca, omiti\u00f3 la limpieza ERROR: no se puede manejar el error de p\u00e1gina para la direcci\u00f3n: ffffa26487064230 PGD 100c00067 P4D 100c00067 PUD 67 PMD 105ed7067 PTE 0 Vaya: 0000 [#1] PREEMPT SMP PTI CPU: 0 PID: 0 Comunicaciones: intercambiador/0 Contaminado: G OE ------- --- 6.7.0-68.fc38.x86_64 #1 Nombre de hardware: Intel Corporaci\u00f3n S2600WFT/S2600WFT, BIOS SE5C620.86B.02.01.0013.121520200651 15/12/2020 RIP: 0010:ioread32be+0x34/0x60 RSP: 0018:ffffa26480003e58 EFLAGS: 2 RAX: ffffa26487064200 RBX: ffff9042d08161a0 RCX: ffff904c108222c0 RDX: 000000010bbf1b80 RSI: ffffffffc055ddb0 RDI: ffffa26487064230 RBP: ffff9042d08161a0 R08: 0000000000000022 R09: ffff904c108222e8 R10: 00000000000000004 R11: 0000000000000441 R12: ffffffc055ddb0 R13: ffffa26487064200 R14: ffffa26480003f00 R15: ffff904c108222c0 FS: 0000000000000000(0000) GS:ffff904c10800000(0000) 0000000000CS: 0010DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffa26487064230 CR3: 00000002c4420006 CR4: 00000000007706f0 DR0: 0000000000000000 DR1: 0000000000 000000 DR2: 0000000000000000 DR3: 00000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Seguimiento de llamadas:  ? __morir+0x23/0x70 ? page_fault_oops+0x171/0x4e0? exc_page_fault+0x175/0x180? asm_exc_page_fault+0x26/0x30? __pfx_poll_health+0x10/0x10 [mlx5_core] ? __pfx_poll_health+0x10/0x10 [mlx5_core] ? ioread32be+0x34/0x60 mlx5_health_check_fatal_sensors+0x20/0x100 [mlx5_core] ? __pfx_poll_health+0x10/0x10 [mlx5_core] poll_health+0x42/0x230 [mlx5_core] ? __next_timer_interrupt+0xbc/0x110? __pfx_poll_health+0x10/0x10 [mlx5_core] call_timer_fn+0x21/0x130? __pfx_poll_health+0x10/0x10 [mlx5_core] __run_timers+0x222/0x2c0 run_timer_softirq+0x1d/0x40 __do_softirq+0xc9/0x2c8 __irq_exit_rcu+0xa6/0xc0 sysvec_apic_timer_interrupt+0x72/0x90   asm_sysvec_apic_timer_interrupt+0x1a/0x20 RIP: 0010:cpuidle_enter_state +0xcc/0x440 ? cpuidle_enter_state+0xbd/0x440 cpuidle_enter+0x2d/0x40 do_idle+0x20d/0x270 cpu_startup_entry+0x2a/0x30 rest_init+0xd0/0xd0 arch_call_rest_init+0xe/0x30 start_kernel+0x709/0xa90 x86_64_start _reservations+0x18/0x30 x86_64_start_kernel+0x96/0xa0 second_startup_64_no_verify+0x18f/0x19b ---[ final de seguimiento 0000000000000000 ]---\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/ethernet/mellanox/mlx5/core/main.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"9b98d395b85dd042fe83fb696b1ac02e6c93a520\",\"lessThan\":\"e7d4485d47839f4d1284592ae242c4e65b2810a9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9b98d395b85dd042fe83fb696b1ac02e6c93a520\",\"lessThan\":\"6ccada6ffb42e0ac75e3db06d41baf5a7f483f8a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9b98d395b85dd042fe83fb696b1ac02e6c93a520\",\"lessThan\":\"e6777ae0bf6fd5bc626bb051c8c93e3c8198a3f8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9b98d395b85dd042fe83fb696b1ac02e6c93a520\",\"lessThan\":\"c8b3f38d2dae0397944814d691a419c451f9906f\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/ethernet/mellanox/mlx5/core/main.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.1\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.1\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.95\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.35\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.9.6\",\"lessThanOrEqual\":\"6.9.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-10T17:06:18.717669Z\",\"id\":\"CVE-2024-40906\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.1\",\"versionEndExcluding\":\"6.1.95\",\"matchCriteriaId\":\"FD98DE98-9D47-474B-A2EF-433D10E7459C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.35\",\"matchCriteriaId\":\"6F019D15-84C0-416B-8C57-7F51B68992F0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.9.6\",\"matchCriteriaId\":\"0ABBBA1D-F79D-4BDB-AA41-D1EDCC4A6975\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.10:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"2EBB4392-5FA6-4DA9-9772-8F9C750109FA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.10:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"331C2F14-12C7-45D5-893D-8C52EE38EA10\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/6ccada6ffb42e0ac75e3db06d41baf5a7f483f8a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c8b3f38d2dae0397944814d691a419c451f9906f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e6777ae0bf6fd5bc626bb051c8c93e3c8198a3f8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e7d4485d47839f4d1284592ae242c4e65b2810a9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6ccada6ffb42e0ac75e3db06d41baf5a7f483f8a\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c8b3f38d2dae0397944814d691a419c451f9906f\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e6777ae0bf6fd5bc626bb051c8c93e3c8198a3f8\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e7d4485d47839f4d1284592ae242c4e65b2810a9\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-28T07:56:48+00:00",
      "cve": "CVE-2024-40906",
      "id": "CVE-2024-40906",
      "initial_release_date": "2024-07-12T00:00:00+00:00",
      "product_status:fixed": "430",
      "product_status:known_affected": "50",
      "product_status:known_not_affected": "22",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net/mlx5: Always stop health timer during driver removal",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-40906.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-29T01:52:37Z",
      "cve": "CVE-2024-40906",
      "id": "CVE-2024-40906",
      "initial_release_date": "2024-07-16T02:35:03Z",
      "product_status:known_affected": "330",
      "product_status:known_not_affected": "293",
      "product_status:recommended": "671",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-40906",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-40906.json",
      "version": "82"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/e7d4485d47839f4d1284592ae242c4e65b2810a9\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/6ccada6ffb42e0ac75e3db06d41baf5a7f483f8a\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/e6777ae0bf6fd5bc626bb051c8c93e3c8198a3f8\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/c8b3f38d2dae0397944814d691a419c451f9906f\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T04:39:55.321Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-40906\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T17:06:18.717669Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:24.890Z\"}}], \"cna\": {\"title\": \"net/mlx5: Always stop health timer during driver removal\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"9b98d395b85dd042fe83fb696b1ac02e6c93a520\", \"lessThan\": \"e7d4485d47839f4d1284592ae242c4e65b2810a9\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9b98d395b85dd042fe83fb696b1ac02e6c93a520\", \"lessThan\": \"6ccada6ffb42e0ac75e3db06d41baf5a7f483f8a\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9b98d395b85dd042fe83fb696b1ac02e6c93a520\", \"lessThan\": \"e6777ae0bf6fd5bc626bb051c8c93e3c8198a3f8\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9b98d395b85dd042fe83fb696b1ac02e6c93a520\", \"lessThan\": \"c8b3f38d2dae0397944814d691a419c451f9906f\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/net/ethernet/mellanox/mlx5/core/main.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.1\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.1\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.1.95\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.35\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9.6\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.9.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/net/ethernet/mellanox/mlx5/core/main.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/e7d4485d47839f4d1284592ae242c4e65b2810a9\"}, {\"url\": \"https://git.kernel.org/stable/c/6ccada6ffb42e0ac75e3db06d41baf5a7f483f8a\"}, {\"url\": \"https://git.kernel.org/stable/c/e6777ae0bf6fd5bc626bb051c8c93e3c8198a3f8\"}, {\"url\": \"https://git.kernel.org/stable/c/c8b3f38d2dae0397944814d691a419c451f9906f\"}], \"x_generator\": {\"engine\": \"bippy-5f407fcff5a0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet/mlx5: Always stop health timer during driver removal\\n\\nCurrently, if teardown_hca fails to execute during driver removal, mlx5\\ndoes not stop the health timer. Afterwards, mlx5 continue with driver\\nteardown. This may lead to a UAF bug, which results in page fault\\nOops[1], since the health timer invokes after resources were freed.\\n\\nHence, stop the health monitor even if teardown_hca fails.\\n\\n[1]\\nmlx5_core 0000:18:00.0: E-Switch: Unload vfs: mode(LEGACY), nvfs(0), necvfs(0), active vports(0)\\nmlx5_core 0000:18:00.0: E-Switch: Disable: mode(LEGACY), nvfs(0), necvfs(0), active vports(0)\\nmlx5_core 0000:18:00.0: E-Switch: Disable: mode(LEGACY), nvfs(0), necvfs(0), active vports(0)\\nmlx5_core 0000:18:00.0: E-Switch: cleanup\\nmlx5_core 0000:18:00.0: wait_func:1155:(pid 1967079): TEARDOWN_HCA(0x103) timeout. Will cause a leak of a command resource\\nmlx5_core 0000:18:00.0: mlx5_function_close:1288:(pid 1967079): tear_down_hca failed, skip cleanup\\nBUG: unable to handle page fault for address: ffffa26487064230\\nPGD 100c00067 P4D 100c00067 PUD 100e5a067 PMD 105ed7067 PTE 0\\nOops: 0000 [#1] PREEMPT SMP PTI\\nCPU: 0 PID: 0 Comm: swapper/0 Tainted: G           OE     -------  ---  6.7.0-68.fc38.x86_64 #1\\nHardware name: Intel Corporation S2600WFT/S2600WFT, BIOS SE5C620.86B.02.01.0013.121520200651 12/15/2020\\nRIP: 0010:ioread32be+0x34/0x60\\nRSP: 0018:ffffa26480003e58 EFLAGS: 00010292\\nRAX: ffffa26487064200 RBX: ffff9042d08161a0 RCX: ffff904c108222c0\\nRDX: 000000010bbf1b80 RSI: ffffffffc055ddb0 RDI: ffffa26487064230\\nRBP: ffff9042d08161a0 R08: 0000000000000022 R09: ffff904c108222e8\\nR10: 0000000000000004 R11: 0000000000000441 R12: ffffffffc055ddb0\\nR13: ffffa26487064200 R14: ffffa26480003f00 R15: ffff904c108222c0\\nFS:  0000000000000000(0000) GS:ffff904c10800000(0000) knlGS:0000000000000000\\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\nCR2: ffffa26487064230 CR3: 00000002c4420006 CR4: 00000000007706f0\\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\\nPKRU: 55555554\\nCall Trace:\\n \u003cIRQ\u003e\\n ? __die+0x23/0x70\\n ? page_fault_oops+0x171/0x4e0\\n ? exc_page_fault+0x175/0x180\\n ? asm_exc_page_fault+0x26/0x30\\n ? __pfx_poll_health+0x10/0x10 [mlx5_core]\\n ? __pfx_poll_health+0x10/0x10 [mlx5_core]\\n ? ioread32be+0x34/0x60\\n mlx5_health_check_fatal_sensors+0x20/0x100 [mlx5_core]\\n ? __pfx_poll_health+0x10/0x10 [mlx5_core]\\n poll_health+0x42/0x230 [mlx5_core]\\n ? __next_timer_interrupt+0xbc/0x110\\n ? __pfx_poll_health+0x10/0x10 [mlx5_core]\\n call_timer_fn+0x21/0x130\\n ? __pfx_poll_health+0x10/0x10 [mlx5_core]\\n __run_timers+0x222/0x2c0\\n run_timer_softirq+0x1d/0x40\\n __do_softirq+0xc9/0x2c8\\n __irq_exit_rcu+0xa6/0xc0\\n sysvec_apic_timer_interrupt+0x72/0x90\\n \u003c/IRQ\u003e\\n \u003cTASK\u003e\\n asm_sysvec_apic_timer_interrupt+0x1a/0x20\\nRIP: 0010:cpuidle_enter_state+0xcc/0x440\\n ? cpuidle_enter_state+0xbd/0x440\\n cpuidle_enter+0x2d/0x40\\n do_idle+0x20d/0x270\\n cpu_startup_entry+0x2a/0x30\\n rest_init+0xd0/0xd0\\n arch_call_rest_init+0xe/0x30\\n start_kernel+0x709/0xa90\\n x86_64_start_reservations+0x18/0x30\\n x86_64_start_kernel+0x96/0xa0\\n secondary_startup_64_no_verify+0x18f/0x19b\\n---[ end trace 0000000000000000 ]---\"}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2024-12-19T09:07:44.725Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-40906\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-12-19T09:07:44.725Z\", \"dateReserved\": \"2024-07-12T12:17:45.580Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-07-12T12:20:46.485Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.