CVE-2024-40940

What it actually does

Double deletion of a tainted pointer instead of valid flow rule pointers in mlx5_lag_create_port_sel_table when flow rule creation fails, leading to memory corruption in the Linux kernel mlx5 driver.

Why it matters to the business

Potential kernel instability or crashes on systems using Mellanox mlx5 network adapters during high-performance networking operations, increasing downtime risk for affected Linux deployments despite low exploit probability.

How an attack unfolds

An attacker triggers a failure during flow rule creation in the mlx5 LAG port selection table setup path, causing repeated deletion of an invalid pointer that corrupts kernel memory; listed threat actors in 2024 campaigns and Linux kernel resource issues highlight relevance to espionage and financial actors targeting kernel flaws, though this specific issue lacks confirmed in-the-wild exploitation.

How to fix it

Update the Linux kernel to a version containing commit 531eab2da27dd42d68dfb841d82e987f4a6738b8 in the stable repository; apply the fix in mlx5_lag_create_port_sel_table to use correct flow rule pointers.

How to confirm the fix worked

Verify kernel source or binary contains the referenced commit hash; test mlx5 LAG flow rule creation failure paths to confirm only valid pointers are deleted.

Typical attack path

1. Identify target system running vulnerable Linux kernel with mlx5 driver and LAG configuration
2. Craft network conditions or API calls to induce flow rule creation failure in mlx5_lag_create_port_sel_table
3. Trigger repeated deletion of the tainted pointer leading to memory corruption
4. Exploit resulting kernel state for denial of service or further privilege escalation

How to detect it

Review kernel logs for mlx5 driver errors during flow rule operations or LAG table creation failures; inspect for repeated pointer deletion patterns or memory corruption traces in dmesg and system crash dumps; correlate with threat actor activity targeting Linux kernel resource issues.

What your security team should do

• Prioritize kernel upgrades for systems with mlx5 hardware in production networks
• Monitor EPSS and KEV updates for changes in exploit likelihood
• Audit network configurations using LAG and flow rules on affected kernels
• Implement kernel hardening and monitoring for memory corruption indicators