PT-2024-29161 · Linux+4 · Linux Kernel+4

Borislav Petkov + 3 · Published 2024-06-02 · Updated 2025-10-06 · CVE-2024-40944

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The issue is related to a bug in the x86/kexec component of the Linux kernel, where the call to cc platform has() triggers a fault and system crash if call depth tracking is active. This occurs because the GS segment has been reset by load segments() and GS BASE is now 0, but call depth tracking uses per-CPU variables to operate. The fix involves calling cc platform has() earlier in the function when GS is still valid.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2025-03431

CVE-2024-40944

OESA-2024-2076

SUSE-SU-2024:3194-1

SUSE-SU-2024:3195-1

SUSE-SU-2024:3383-1

SUSE-SU-2025:20044-1

SUSE-SU-2025:20047-1

USN-6999-1

USN-6999-2

USN-7004-1

USN-7005-1

USN-7005-2

USN-7008-1

USN-7029-1

Affected Products

Linuxmint

Linux Kernel

Red Os

Suse

Ubuntu

References · 1295

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/40xxx/CVE-2024-40944.json · Exploit
• https://ubuntu.com/security/CVE-2024-40957 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-40984 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-41002 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-41030 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-39504 · Security Note
• https://ubuntu.com/security/CVE-2024-38780 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-42230 · Security Note
• https://ubuntu.com/security/CVE-2024-38622 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-40921 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-41087 · Security Note
• https://ubuntu.com/security/CVE-2024-39489 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7029-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-40944 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-41054 · Security Note