CVE-2024-40920: net: bridge: mst: fix suspicious rcu usage in br_mst_set_state
In the Linux kernel, the following vulnerability has been resolved:
net: bridge: mst: fix suspicious rcu usage in brmstsetstate
I converted brmstsetstate to RCU to avoid a vlan use-after-free but forgot to change the vlan group dereference helper. Switch to vlan group RCU deref helper to fix the suspicious rcu usage warning.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.129-1~deb11u1 - Compensating control
Switch the VLAN group dereference helper to the RCU VLAN-group deref helper to fix the suspicious RCU usage warning in net: bridge: mst (br_mst_set_state).
Event History
Frequently Asked Questions
What is the severity of CVE-2024-40920?
CVE-2024-40920 has a severity rating that should be assessed based on its impact on system stability and security, particularly regarding the risk of use-after-free vulnerabilities.
How do I fix CVE-2024-40920?
To fix CVE-2024-40920, update your Linux kernel to one of the remedied versions such as 5.10.223-1, 5.10.226-1, 6.1.123-1, or higher.
What are the affected versions in CVE-2024-40920?
CVE-2024-40920 affects specific Linux kernel versions including 5.10.223-1, 5.10.226-1, 6.1.119-1, among others.
Is there any workaround for CVE-2024-40920?
There are no known workarounds for CVE-2024-40920, and upgrading to a patched kernel is recommended.
What could happen if CVE-2024-40920 is exploited?
Exploitation of CVE-2024-40920 could potentially lead to system instability or unauthorized access due to the use-after-free vulnerability.