CVE-2024-40985

What it actually does

Memory leak of ao_info structure on error paths during TCP-AO setup in the kernel network stack.

Why it matters to the business

Repeated triggering can cause gradual kernel memory exhaustion on network-facing systems, leading to degraded performance, instability, or crashes in high-connection environments.

How an attack unfolds

An attacker triggers error conditions in TCP-AO connection setup to force allocation of ao_info without corresponding release, accumulating leaks over multiple attempts.

How to fix it

Update the Linux kernel to a version containing commit ebaa7d3c26332330a48f9a15f8e518d526cc0f21 or later equivalent stable release that resolves the ao_info leak.

How to confirm the fix worked

Confirm the fix commit is present in the kernel source tree or verify updated kernel packages eliminate the leak on error paths.

Typical attack path

1. Target systems supporting TCP-AO in the Linux kernel
2. Send crafted connection attempts that hit the error path in ao_info handling
3. Repeat connection attempts to accumulate leaked memory

How to detect it

Review kernel logs for TCP-AO initialization errors and track system memory usage trends for unexplained increases tied to network activity.

What your security team should do

• Apply the kernel patch containing the referenced fix commit as soon as possible
• Audit systems for TCP-AO usage and disable if not required
• Monitor kernel memory statistics for anomalous growth on patched systems