CVE-2024-40937

What it actually does

The gve_rx_free_skb function frees an skb with dev_kfree_skb_any but leaves napi->skb holding a dangling reference, allowing a subsequent napi_get_frags call to return a pointer to already-freed memory and triggering a use-after-free.

Why it matters to the business

Unpatched kernels may experience crashes or unpredictable behavior in network processing on affected systems, leading to downtime and requiring urgent updates across Linux deployments that use the gve driver.

How an attack unfolds

An attacker triggers repeated receive operations on a gve interface to force the race between skb free and napi->skb reuse; once the dangling pointer is dereferenced, memory corruption occurs that can be leveraged for privilege escalation or denial of service.

How to fix it

Upgrade the Linux kernel to the commit 75afd8724739ee5ed8165acde5f6ac3988b485cc or later stable releases that contain the fix; rebuild and reboot affected systems.

How to confirm the fix worked

Confirm the running kernel contains commit 75afd8724739ee5ed8165acde5f6ac3988b485cc; inspect the gve driver source for the napi->skb = NULL assignment before dev_kfree_skb_any and test RX paths under load.

Typical attack path

1. Identify a system using the gve driver in a virtualized environment
2. Send crafted network traffic or trigger RX paths that exercise gve_rx_free_skb
3. Force napi_get_frags to return the stale pointer
4. Dereference the freed memory to cause kernel panic or corruption
5. Escalate to code execution or system denial of service

How to detect it

Review kernel logs for gve-related oops or use-after-free warnings; examine crash dumps for references to napi->skb after dev_kfree_skb_any calls in the gve receive path.

What your security team should do

• Prioritize patching all systems using the gve driver within the next maintenance window
• Monitor kernel update channels for backported fixes in distribution kernels
• Restrict untrusted network access to gve interfaces until patched
• Review virtualization platform configurations that expose gve devices