CVE-2024-40985

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to the version that includes the fix for the issue introduced in version 5 of TCP-AO patches

Description The issue is related to a leak of ao info on the error path in the net/tcp ao component of the Linux kernel. It was introduced together with TCP AO CMDF AO REQUIRED in version 5 of the TCP-AO patches. The issue is frustrating given the existence of selftests, and the use of kmemtest and kcov was always pending.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.