CVE-2024-40999

What it actually does

The vulnerability permits invalid completion descriptors in the ENA network driver where the 'first' flag is set on descriptors other than the initial one in multi-buffer packets, allowing undetected RX data corruption that triggers a kernel reset.

Why it matters to the business

Linux systems relying on the ENA driver may experience unexpected resets and network interruptions, causing operational downtime; the stable low EPSS and lack of KEV status indicate limited real-world urgency despite broad kernel prevalence.

How an attack unfolds

An attacker supplies network traffic that induces malformed multi-buffer completion descriptors in the ENA driver; without the added consistency check, the invalid 'first' flag placement leads to RX data corruption detection and forced reset.

How to fix it

Upgrade the Linux kernel to a version containing commit 42146ee5286f16f1674a84f7c274dcca65c6ff2e or newer that includes the descriptor validation and new RX data corruption reset reason.

How to confirm the fix worked

Confirm the presence of the validation logic for the 'first' flag on the first descriptor only in ENA completion descriptor handling, and verify no resets occur under multi-buffer RX workloads.

Typical attack path

1. Send crafted network packets to the ENA interface
2. Trigger multi-buffer descriptor processing in the driver
3. Exploit missing validation on the 'first' flag
4. Induce RX data corruption state
5. Force kernel reset

How to detect it

Review kernel logs and dmesg output for ENA driver messages mentioning invalid descriptors or RX data corruption resets; correlate with network traffic patterns that exercise multi-buffer RX paths.

What your security team should do

• Apply the kernel fix containing commit 42146ee5286f16f1674a84f7c274dcca65c6ff2e across all affected systems
• Monitor kernel logs for ENA-related reset events
• Test network stability post-upgrade under representative traffic loads