CVE-2024-40910

What it actually does

Refcount imbalance in AX25 inbound connection handling where ax25_accept() omits netdev_hold()/ax25_dev_hold() calls, causing underflow on ax25_release() and leading to use-after-free, kernel warnings, and crashes during socket close or netdevice unregister.

Why it matters to the business

Linux systems using the AX25 protocol may experience unexpected kernel panics and reboots, resulting in service disruption and potential data loss in amateur radio or specialized networking environments; the issue has been present for over two years with no observed exploitation trend.

How an attack unfolds

An attacker establishes an inbound AX25 connection to trigger the missing refcount increment path, then closes the socket or triggers interface removal to induce the refcount underflow and kernel crash; listed threat actor campaigns involving Linux kernel flaws provide context for potential targeting but no confirmed exploitation of this specific issue.

How to fix it

Upgrade the Linux kernel to the fixed commit f4df9d6c8d4e4c818252b0419c2165d66eabd4eb in the stable repository; apply the patch ensuring netdev_hold() and ax25_dev_hold() are called in ax25_accept() to match ax25_bind() logic.

How to confirm the fix worked

Verify the applied kernel commit contains f4df9d6c8d4e4c818252b0419c2165d66eabd4eb, reproduce inbound AX25 connections followed by release without observing refcount warnings or unregister hangs, and confirm no 'decrement hit 0' or 'underflow' messages in dmesg.

Typical attack path

1. Identify target systems exposing AX25 sockets
2. Initiate inbound connection via ax25_accept() path
3. Trigger socket release to execute ax25_release() without prior hold
4. Observe refcount underflow warnings followed by crash or hang on netdevice cleanup

How to detect it

Search kernel logs and dmesg for refcount underflow or decrement-hit-0 warnings originating from ax25_release(), followed by traces involving sock_close or unregister_netdevice hangs; check for infinite loops waiting on AX25 interface usage count reaching zero.

• refcount_t: decrement hit 0; leaking memory.
• refcount_t: underflow; use-after-free.
• ax25_release+0x2ad/0x360
• unregister_netdevice: waiting for ax0 to become free. Usage count = 0

What your security team should do

• Prioritize kernel upgrade on any systems exposing AX25 interfaces
• Monitor kernel logs for refcount saturation warnings on affected hosts
• Disable AX25 protocol modules if not required to reduce attack surface
• Test the fixed commit in staging environments before production rollout