CVE-2024-40956

What it actually does

Use-after-free in dmaengine idxd irq_process_work_list when list iteration via non-safe macro allows descriptor reuse after idxd_desc_complete frees it without removal.

Why it matters to the business

Kernel memory corruption risk can lead to system crashes, denial of service, or local privilege escalation on affected Linux systems; urgency is moderate given low EPSS and no KEV listing despite broad kernel exposure.

How an attack unfolds

An attacker with local access crafts DMA operations that cause concurrent descriptor reuse during list processing in irq context, triggering the unsafe iterator to dereference freed memory; listed threat actor campaigns targeting Linux kernel flaws provide context for potential targeted exploitation.

How to fix it

Update to fixed kernel versions containing the list_for_each_entry_safe change; for listed Debian packages apply webkit2gtk 2.44.2-1~deb11u1 (Debian 11), 2.44.2-1~deb12u1 (Debian 12), 2.44.2-1 (Debian 13) and equivalent wpewebkit updates.

How to confirm the fix worked

Confirm kernel source contains list_for_each_entry_safe in irq_process_work_list and test DMA workloads that previously triggered reuse; verify package versions match the listed fixed releases via dpkg or package manager.

Typical attack path

1. Obtain local code execution on affected Linux host
2. Trigger DMA submission paths that populate irq_process_work_list
3. Force descriptor completion and reuse while iterator still holds reference
4. Exploit resulting UAF for memory corruption or control flow hijack

How to detect it

Review kernel logs for oops or warnings referencing idxd or irq_process_work_list around DMA activity; examine auditd or syscall traces for unusual descriptor submission patterns from untrusted processes.

What your security team should do

• Prioritize kernel updates on systems using idxd DMA engine
• Monitor EPSS trend stability and re-evaluate if new exploit code appears
• Apply listed Debian package fixes for webkit2gtk/wpewebkit where present
• Restrict unprivileged DMA access via device permissions until patched