CVE-2024-40906

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.7.0-68.fc38.x86 64

Description The vulnerability is related to the net/mlx5 driver in the Linux kernel. If the teardown hca function fails during driver removal, the health timer is not stopped, which can lead to a Use-After-Free (UAF) bug. This bug results in a page fault, as the health timer invokes after resources have been freed. The issue is resolved by stopping the health monitor even if teardown hca fails.

Recommendations To resolve the issue, update the Linux kernel to a version that includes the fix for this vulnerability. Specifically, update to a version later than 6.7.0-68.fc38.x86 64. As a temporary workaround, consider disabling the health timer during driver removal to prevent the UAF bug. However, this is not a permanent solution and updating the kernel is the recommended course of action.