CVE-2024-40939

What it actually does

The flaw causes a tainted pointer holding an error code (instead of a valid region) to be passed to the delete path in ipc_devlink_create_region() within the iosm WWAN driver, resulting in invalid memory dereference or corruption.

Why it matters to the business

Linux systems using certain cellular modems may experience kernel instability or crashes during driver initialization failures, disrupting network connectivity until the kernel is updated.

How an attack unfolds

An attacker with local access triggers a failure during region creation in the iosm driver on supported WWAN hardware; the subsequent delete loop then operates on the error-valued pointer instead of a valid region object.

How to fix it

Update the Linux kernel to a version containing commit fe394d59cdae81389dbf995e87c83c1acd120597 or newer stable releases that include the index decrement fix before deletion.

How to confirm the fix worked

Confirm the patch is present by inspecting the iosm devlink code for the region index adjustment prior to delete, or verify no tainted-pointer usage occurs in failure paths during testing.

Typical attack path

1. Trigger failure condition in ipc_devlink_create_region()
2. Allow delete loop to start from the tainted pointer
3. Cause invalid memory access or kernel corruption during cleanup

How to detect it

Review kernel logs for iosm driver errors, devlink region creation failures, or oops/panic messages referencing tainted pointers or invalid region deletes during WWAN initialization.

What your security team should do

• Apply the referenced kernel commit or newer stable version immediately on affected systems
• Prioritize updates for devices with WWAN/iosm hardware
• Monitor kernel logs for iosm or devlink region errors