CVE-2024-40909 is a use-after-free vulnerability in the Linux kernel's BPF subsystem, specifically within the bpf_link_free() function. This flaw, introduced after a specific commit, allows for the potential misuse of freed memory due to redundant deallocation calls. Rated 7.8 HIGH (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), it could lead to high confidentiality, integrity, and availability impacts through local exploitation with low privileges and complexity. There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this vulnerability.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 6.6.26, < 6.6.35CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | ||
>= 6.9, < 6.9.6CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | ||
6.10CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:6.10:rc1:*:*:*:*:*:* | ||
6.10CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:6.10:rc2:*:*:*:*:*:* | ||
>= 6.6.26, < 6.6.35CPE match | cpe:2.3:a:linux:linux_kernel:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.