GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-40937 (GCVE-0-2024-40937)

Vulnerability from cvelistv5 – Published: 2024-07-12 12:25 – Updated: 2026-08-05 11:34
VLAI
Title
gve: Clear napi->skb before dev_kfree_skb_any()
Summary
In the Linux kernel, the following vulnerability has been resolved: gve: Clear napi->skb before dev_kfree_skb_any() gve_rx_free_skb incorrectly leaves napi->skb referencing an skb after it is freed with dev_kfree_skb_any(). This can result in a subsequent call to napi_get_frags returning a dangling pointer. Fix this by clearing napi->skb before the skb is freed.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-10 17:04 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 9b8dd5e5ea48bbb7532d20c4093a79d8283e4029 , < 75afd8724739ee5ed8165acde5f6ac3988b485cc (git)
Affected: 9b8dd5e5ea48bbb7532d20c4093a79d8283e4029 , < d221284991118c0ab16480b53baecd857c0bc442 (git)
Affected: 9b8dd5e5ea48bbb7532d20c4093a79d8283e4029 , < 2ce5341c36993b776012601921d7688693f8c037 (git)
Affected: 9b8dd5e5ea48bbb7532d20c4093a79d8283e4029 , < a68184d5b420ea4fc7e6b7ceb52bbc66f90d3c50 (git)
Affected: 9b8dd5e5ea48bbb7532d20c4093a79d8283e4029 , < 6f4d93b78ade0a4c2cafd587f7b429ce95abb02e (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.14
Unaffected: 0 , < 5.14 (semver)
Unaffected: 5.15.162 , ≤ 5.15.* (semver)
Unaffected: 6.1.95 , ≤ 6.1.* (semver)
Unaffected: 6.6.35 , ≤ 6.6.* (semver)
Unaffected: 6.9.6 , ≤ 6.9.* (semver)
Unaffected: 6.10 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T21:58:03.988Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/75afd8724739ee5ed8165acde5f6ac3988b485cc"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/d221284991118c0ab16480b53baecd857c0bc442"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/2ce5341c36993b776012601921d7688693f8c037"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/a68184d5b420ea4fc7e6b7ceb52bbc66f90d3c50"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/6f4d93b78ade0a4c2cafd587f7b429ce95abb02e"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-40937",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T17:04:39.753649Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:34:26.574Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/google/gve/gve_rx_dqo.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "75afd8724739ee5ed8165acde5f6ac3988b485cc",
              "status": "affected",
              "version": "9b8dd5e5ea48bbb7532d20c4093a79d8283e4029",
              "versionType": "git"
            },
            {
              "lessThan": "d221284991118c0ab16480b53baecd857c0bc442",
              "status": "affected",
              "version": "9b8dd5e5ea48bbb7532d20c4093a79d8283e4029",
              "versionType": "git"
            },
            {
              "lessThan": "2ce5341c36993b776012601921d7688693f8c037",
              "status": "affected",
              "version": "9b8dd5e5ea48bbb7532d20c4093a79d8283e4029",
              "versionType": "git"
            },
            {
              "lessThan": "a68184d5b420ea4fc7e6b7ceb52bbc66f90d3c50",
              "status": "affected",
              "version": "9b8dd5e5ea48bbb7532d20c4093a79d8283e4029",
              "versionType": "git"
            },
            {
              "lessThan": "6f4d93b78ade0a4c2cafd587f7b429ce95abb02e",
              "status": "affected",
              "version": "9b8dd5e5ea48bbb7532d20c4093a79d8283e4029",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/google/gve/gve_rx_dqo.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.14"
            },
            {
              "lessThan": "5.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.162",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.95",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.10",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.162",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.95",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.35",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9.6",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngve: Clear napi-\u003eskb before dev_kfree_skb_any()\n\ngve_rx_free_skb incorrectly leaves napi-\u003eskb referencing an skb after it\nis freed with dev_kfree_skb_any(). This can result in a subsequent call\nto napi_get_frags returning a dangling pointer.\n\nFix this by clearing napi-\u003eskb before the skb is freed."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable code is the gVNIC DQO NAPI receive poll (`gve_rx_poll_dqo`), executed in softirq context for every frame arriving on the wire. gve is the primary NIC on Google Compute Engine instances that are routinely internet-facing, so a remote attacker reaches the code purely by sending packets.\nAC:L - The attacker controls both trigger ingredients \u2014 packet shape (large multi-buffer/RSC frames above rx_copybreak, malformed or truncated frames causing the device to set rx_error mid-packet) and the traffic volume that drives the GFP_ATOMIC allocation failures in gve_rx_append_frags/gve_rx_copy_ondemand. The error path can be provoked repeatedly at line rate until it lands.\nPR:N - There is no syscall, ioctl, socket, capability check or authentication anywhere on the path; the receive poll runs unconditionally on incoming frames. An entirely unauthenticated off-host attacker can reach it.\nUI:N - No victim action is required \u2014 the driver processes received packets automatically in softirq context. Simply having the interface up is sufficient.\nS:U - The corruption is confined to the kernel\u0027s own memory within the same security authority; there is no crossing of a VM, IOMMU or sandbox boundary. Standard kernel-level compromise is Unchanged.\nC:H - The stale napi-\u003eskb is a freed sk_buff on the heavily-sprayable skbuff_head_cache; the driver and the subsequent napi_gro_frags/GRO path read skb-\u003ehead, skb-\u003edata, skb_headlen and skb_shinfo from reallocated memory, so attacker-groomed or unrelated kernel data is parsed and can be leaked out via the receive path.\nI:H - The dangling pointer is written through \u2014 skb_add_rx_frag updates len/data_len/truesize and skb_shinfo, and gve_rx_complete_skb writes hash, ip_summed, gso_type and gso_size into freed memory \u2014 giving a write-after-free into a general-purpose slab plus a subsequent double free, which is the classic basis for control-flow hijack and privilege escalation.\nA:H - Use of the freed sk_buff reliably produces slab corruption, KASAN splats, list corruption and kernel panics, and the double free of the skb compounds this. A remote attacker can crash the host repeatedly."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:34:07.395Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/75afd8724739ee5ed8165acde5f6ac3988b485cc"
        },
        {
          "url": "https://git.kernel.org/stable/c/d221284991118c0ab16480b53baecd857c0bc442"
        },
        {
          "url": "https://git.kernel.org/stable/c/2ce5341c36993b776012601921d7688693f8c037"
        },
        {
          "url": "https://git.kernel.org/stable/c/a68184d5b420ea4fc7e6b7ceb52bbc66f90d3c50"
        },
        {
          "url": "https://git.kernel.org/stable/c/6f4d93b78ade0a4c2cafd587f7b429ce95abb02e"
        }
      ],
      "title": "gve: Clear napi-\u003eskb before dev_kfree_skb_any()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-40937",
    "datePublished": "2024-07-12T12:25:13.807Z",
    "dateReserved": "2024-07-12T12:17:45.584Z",
    "dateUpdated": "2026-08-05T11:34:07.395Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-40937",
      "date": "2026-09-16",
      "epss": "0.00736",
      "percentile": "0.52732"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ngve: Clear napi-\u003eskb before dev_kfree_skb_any()\\n\\ngve_rx_free_skb incorrectly leaves napi-\u003eskb referencing an skb after it\\nis freed with dev_kfree_skb_any(). This can result in a subsequent call\\nto napi_get_frags returning a dangling pointer.\\n\\nFix this by clearing napi-\u003eskb before the skb is freed.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se resolvi\\u00f3 la siguiente vulnerabilidad: gve: Borrar napi-\u0026gt;skb antes de dev_kfree_skb_any() gve_rx_free_skb deja incorrectamente napi-\u0026gt;skb haciendo referencia a un skb despu\\u00e9s de liberarlo con dev_kfree_skb_any(). Esto puede resultar en una llamada posterior a napi_get_frags que devuelva un puntero colgante. Solucione este problema borrando napi-\u0026gt;skb antes de liberar el skb.\"}]",
      "id": "CVE-2024-40937",
      "lastModified": "2024-11-21T09:31:54.487",
      "published": "2024-07-12T13:15:16.187",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/2ce5341c36993b776012601921d7688693f8c037\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/6f4d93b78ade0a4c2cafd587f7b429ce95abb02e\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/75afd8724739ee5ed8165acde5f6ac3988b485cc\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/a68184d5b420ea4fc7e6b7ceb52bbc66f90d3c50\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/d221284991118c0ab16480b53baecd857c0bc442\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/2ce5341c36993b776012601921d7688693f8c037\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/6f4d93b78ade0a4c2cafd587f7b429ce95abb02e\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/75afd8724739ee5ed8165acde5f6ac3988b485cc\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/a68184d5b420ea4fc7e6b7ceb52bbc66f90d3c50\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/d221284991118c0ab16480b53baecd857c0bc442\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-40937\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-07-12T13:15:16.187\",\"lastModified\":\"2026-08-04T11:19:07.187\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ngve: Clear napi-\u003eskb before dev_kfree_skb_any()\\n\\ngve_rx_free_skb incorrectly leaves napi-\u003eskb referencing an skb after it\\nis freed with dev_kfree_skb_any(). This can result in a subsequent call\\nto napi_get_frags returning a dangling pointer.\\n\\nFix this by clearing napi-\u003eskb before the skb is freed.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: gve: Borrar napi-\u0026gt;skb antes de dev_kfree_skb_any() gve_rx_free_skb deja incorrectamente napi-\u0026gt;skb haciendo referencia a un skb despu\u00e9s de liberarlo con dev_kfree_skb_any(). Esto puede resultar en una llamada posterior a napi_get_frags que devuelva un puntero colgante. Solucione este problema borrando napi-\u0026gt;skb antes de liberar el skb.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/ethernet/google/gve/gve_rx_dqo.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"9b8dd5e5ea48bbb7532d20c4093a79d8283e4029\",\"lessThan\":\"75afd8724739ee5ed8165acde5f6ac3988b485cc\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9b8dd5e5ea48bbb7532d20c4093a79d8283e4029\",\"lessThan\":\"d221284991118c0ab16480b53baecd857c0bc442\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9b8dd5e5ea48bbb7532d20c4093a79d8283e4029\",\"lessThan\":\"2ce5341c36993b776012601921d7688693f8c037\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9b8dd5e5ea48bbb7532d20c4093a79d8283e4029\",\"lessThan\":\"a68184d5b420ea4fc7e6b7ceb52bbc66f90d3c50\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9b8dd5e5ea48bbb7532d20c4093a79d8283e4029\",\"lessThan\":\"6f4d93b78ade0a4c2cafd587f7b429ce95abb02e\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/ethernet/google/gve/gve_rx_dqo.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.14\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.14\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.162\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.95\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.35\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.9.6\",\"lessThanOrEqual\":\"6.9.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-10T17:04:39.753649Z\",\"id\":\"CVE-2024-40937\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.14\",\"versionEndExcluding\":\"5.15.162\",\"matchCriteriaId\":\"0A48FD5B-D0CA-4E4C-8D52-9395CBE79191\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.95\",\"matchCriteriaId\":\"D435765D-2766-44F5-B319-F713A13E35CE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.35\",\"matchCriteriaId\":\"6F019D15-84C0-416B-8C57-7F51B68992F0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.9.6\",\"matchCriteriaId\":\"0ABBBA1D-F79D-4BDB-AA41-D1EDCC4A6975\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.10:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"2EBB4392-5FA6-4DA9-9772-8F9C750109FA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.10:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"331C2F14-12C7-45D5-893D-8C52EE38EA10\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.10:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"3173713D-909A-4DD3-9DD4-1E171EB057EE\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/2ce5341c36993b776012601921d7688693f8c037\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6f4d93b78ade0a4c2cafd587f7b429ce95abb02e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/75afd8724739ee5ed8165acde5f6ac3988b485cc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a68184d5b420ea4fc7e6b7ceb52bbc66f90d3c50\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d221284991118c0ab16480b53baecd857c0bc442\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/2ce5341c36993b776012601921d7688693f8c037\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6f4d93b78ade0a4c2cafd587f7b429ce95abb02e\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/75afd8724739ee5ed8165acde5f6ac3988b485cc\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a68184d5b420ea4fc7e6b7ceb52bbc66f90d3c50\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d221284991118c0ab16480b53baecd857c0bc442\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T18:43:22+00:00",
      "cve": "CVE-2024-40937",
      "id": "CVE-2024-40937",
      "initial_release_date": "2024-07-12T00:00:00+00:00",
      "product_status:known_affected": "156",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: gve: Clear napi-\u0026gt;skb before dev_kfree_skb_any()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-40937.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-05T00:43:13Z",
      "cve": "CVE-2024-40937",
      "id": "CVE-2024-40937",
      "initial_release_date": "2024-07-16T02:34:36Z",
      "product_status:known_affected": "325",
      "product_status:known_not_affected": "74",
      "product_status:recommended": "997",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-40937",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-40937.json",
      "version": "101"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/75afd8724739ee5ed8165acde5f6ac3988b485cc\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/d221284991118c0ab16480b53baecd857c0bc442\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/2ce5341c36993b776012601921d7688693f8c037\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/a68184d5b420ea4fc7e6b7ceb52bbc66f90d3c50\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/6f4d93b78ade0a4c2cafd587f7b429ce95abb02e\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T21:58:03.988Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-40937\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T17:04:39.753649Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:22.811Z\"}}], \"cna\": {\"title\": \"gve: Clear napi-\u003eskb before dev_kfree_skb_any()\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"9b8dd5e5ea48bbb7532d20c4093a79d8283e4029\", \"lessThan\": \"75afd8724739ee5ed8165acde5f6ac3988b485cc\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9b8dd5e5ea48bbb7532d20c4093a79d8283e4029\", \"lessThan\": \"d221284991118c0ab16480b53baecd857c0bc442\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9b8dd5e5ea48bbb7532d20c4093a79d8283e4029\", \"lessThan\": \"2ce5341c36993b776012601921d7688693f8c037\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9b8dd5e5ea48bbb7532d20c4093a79d8283e4029\", \"lessThan\": \"a68184d5b420ea4fc7e6b7ceb52bbc66f90d3c50\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9b8dd5e5ea48bbb7532d20c4093a79d8283e4029\", \"lessThan\": \"6f4d93b78ade0a4c2cafd587f7b429ce95abb02e\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/net/ethernet/google/gve/gve_rx_dqo.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.14\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.14\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.15.162\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.95\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.35\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9.6\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.9.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/net/ethernet/google/gve/gve_rx_dqo.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/75afd8724739ee5ed8165acde5f6ac3988b485cc\"}, {\"url\": \"https://git.kernel.org/stable/c/d221284991118c0ab16480b53baecd857c0bc442\"}, {\"url\": \"https://git.kernel.org/stable/c/2ce5341c36993b776012601921d7688693f8c037\"}, {\"url\": \"https://git.kernel.org/stable/c/a68184d5b420ea4fc7e6b7ceb52bbc66f90d3c50\"}, {\"url\": \"https://git.kernel.org/stable/c/6f4d93b78ade0a4c2cafd587f7b429ce95abb02e\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ngve: Clear napi-\u003eskb before dev_kfree_skb_any()\\n\\ngve_rx_free_skb incorrectly leaves napi-\u003eskb referencing an skb after it\\nis freed with dev_kfree_skb_any(). This can result in a subsequent call\\nto napi_get_frags returning a dangling pointer.\\n\\nFix this by clearing napi-\u003eskb before the skb is freed.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.162\", \"versionStartIncluding\": \"5.14\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.95\", \"versionStartIncluding\": \"5.14\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.35\", \"versionStartIncluding\": \"5.14\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9.6\", \"versionStartIncluding\": \"5.14\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10\", \"versionStartIncluding\": \"5.14\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-05-04T09:18:20.359Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-40937\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-11-03T21:58:03.988Z\", \"dateReserved\": \"2024-07-12T12:17:45.584Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-07-12T12:25:13.807Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.