CVE-2024-40944

MEDIUM

Linux Kernel - System Crash via Call Depth Tracking

Title source: llm

Description

In the Linux kernel, the following vulnerability has been resolved: x86/kexec: Fix bug with call depth tracking The call to cc_platform_has() triggers a fault and system crash if call depth tracking is active because the GS segment has been reset by load_segments() and GS_BASE is now 0 but call depth tracking uses per-CPU variables to operate. Call cc_platform_has() earlier in the function when GS is still valid. [ bp: Massage. ]

References (3)

Core 3

Core References

Patch

https://git.kernel.org/stable/c/d91ddd05082691e69b30744825d18ae799293258

Patch

https://git.kernel.org/stable/c/2cfb464669b645a9b98478b74f2bcea9860dcff1

Patch

https://git.kernel.org/stable/c/93c1800b3799f17375989b0daf76497dd3e80922

Scores

CVSS v3 5.5

EPSS 0.0024

EPSS Percentile 15.1%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

Status published

Products (12)

linux/Kernel 6.2.0 - 6.6.35linux

linux/Kernel 6.7.0 - 6.9.6linux

Linux/Linux < 6.2

Linux/Linux 5d8213864ade86b48fc492584ea86d65a62f892e - 2cfb464669b645a9b98478b74f2bcea9860dcff1

Linux/Linux 5d8213864ade86b48fc492584ea86d65a62f892e - 93c1800b3799f17375989b0daf76497dd3e80922

Linux/Linux 5d8213864ade86b48fc492584ea86d65a62f892e - d91ddd05082691e69b30744825d18ae799293258

Linux/Linux 6.10

Linux/Linux 6.2

Linux/Linux 6.6.35 - 6.6.*

Linux/Linux 6.9.6 - 6.9.*

... and 2 more

Published Jul 12, 2024

Tracked Since Feb 18, 2026