CVE-2024-40982

What it actually does

Potential NULL pointer dereference in ssb_device_uevent() because the dev pointer is dereferenced before the NULL check in the Linux kernel SSB subsystem.

Why it matters to the business

May trigger kernel crashes or denial of service on affected Linux systems such as Debian 13, causing unplanned downtime and requiring emergency patching of widely deployed kernels.

How an attack unfolds

An attacker supplies a NULL dev pointer to ssb_device_uevent via crafted device events or hardware interactions in the SSB bus, bypassing the intended safety check and forcing a kernel dereference.

How to fix it

Upgrade the linux package on Debian 13 to version 6.9.7-1 or later; rebuild and reboot with the patched kernel to correct the ordering of the NULL check.

How to confirm the fix worked

Confirm the running kernel is at least 6.9.7-1, inspect ssb_device_uevent source to verify the NULL check precedes any dereference, and test uevent paths under NULL conditions.

Typical attack path

1. Locate a system running a vulnerable Linux kernel with the SSB driver loaded
2. Trigger device uevent paths that pass a NULL dev pointer to ssb_device_uevent
3. Force the premature dereference to induce a kernel oops or panic

How to detect it

Review kernel logs and oops reports for entries referencing ssb_device_uevent and NULL pointer dereference; correlate with device addition or uevent activity.

What your security team should do

• Apply the 6.9.7-1 kernel update across all Debian 13 systems without delay
• Prioritize reboot schedules for production hosts using SSB hardware
• Add kernel NULL dereference monitoring to existing crash-log pipelines