medium 5.5

CVE-2024-40945 json

iommu: Return right value in iommu_sva_bind_device()

published 2024-07-12 2 y ago modified 2026-10-15 25 d ago also EUVD-2024-38833

cvss: 5.5; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 0.3%; EPSS 0.3% chance of exploitation in 30 days, percentile 17%
public exploits: 0; none known

In the Linux kernel, the following vulnerability has been resolved:

iommu_sva_bind_device() should return either a sva bond handle or an ERR_PTR value in error cases. Existing drivers (idxd and uacce) only check the return value with IS_ERR(). This could potentially lead to a kernel NULL pointer dereference issue if the function returns NULL instead of an error pointer.

In reality, this doesn't cause any problems because iommu_sva_bind_device() only returns NULL when the kernel is not configured with CONFIG_IOMMU_SVA. In this case, iommu_dev_enable_feature(dev, IOMMU_DEV_FEAT_SVA) will return an error, and the device drivers won't call iommu_sva_bind_device() at all.

Patch / fix

fixed in 3 distros 4 links 7

Linux Linux 5.4.279, 5.10.221, 5.15.162, 6.1.129, 6.6.35, 6.9.6, 6.10
Siemens RUGGEDCOM RST2428P V3.1
Siemens SCALANCE XCM-/XRM-/XCH-/XRH-300 family V3.1

debian ubuntu red hat suse

linux Debian 12 6.1.129-1
linux Debian 14, Debian 13 6.9.7-1

debian advisories DEBIAN-CVE-2024-40945

linux Ubuntu 20.04 LTS 5.4.0-195.215
linux Ubuntu 22.04 LTS 5.15.0-121.131
linux Ubuntu 24.04 LTS 6.8.0-44.44
linux-aws Ubuntu 20.04 LTS 5.4.0-1132.142
linux-aws Ubuntu 22.04 LTS 5.15.0-1069.75
linux-aws Ubuntu 24.04 LTS 6.8.0-1015.16
linux-gcp Ubuntu 20.04 LTS 5.4.0-1136.145
linux-gcp Ubuntu 22.04 LTS 5.15.0-1068.76

ubuntu advisories UBUNTU-CVE-2024-40945

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

kernel RHEL 9 5.14.0-503.11.1.el9_5
rv RHEL 9 5.14.0-503.11.1.el9_5
perf RHEL 9 5.14.0-503.11.1.el9_5
rtla RHEL 9 5.14.0-503.11.1.el9_5
bpftool RHEL 9 7.4.0-503.11.1.el9_5
libperf RHEL 9 5.14.0-503.11.1.el9_5
kernel-rt RHEL 9 5.14.0-503.11.1.el9_5
kernel-64k RHEL 9 5.14.0-503.11.1.el9_5

red hat advisories RHSA-2024:9315

kernel-rt Linux Micro 6.0 6.4.0-10.1
kernel-source-rt Linux Micro 6.0 6.4.0-10.1
kernel-livepatch-MICRO-6-0-RT_Update_2 Linux Micro 6.0 1-1.1
kernel-source Linux Micro 6.0 6.4.0-19.1
kernel-default Linux Micro 6.0 6.4.0-19.1
kernel-kvmsmall Linux Micro 6.0 6.4.0-19.1
kernel-default-base Linux Micro 6.0 6.4.0-17.1.1.51
kernel-livepatch-MICRO-6-0_Update_2 Linux Micro 6.0 1-1.1

suse advisories SUSE-SU-2025:20047-1 SUSE-SU-2025:20044-1 SUSE-SU-2024:3383-1 SUSE-SU-2024:3195-1 SUSE-SU-2024:3194-1 SUSE-SU-2024:2947-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-40945 updated 2026-11-06 cvss 4.4

kernel: iommu: Return right value in iommu_sva_bind_device()

Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 more
affected: no fix planned “Out of support scope”
Red Hat Enterprise Linux 8 perf, kernel, bpftool, kernel-rt, kernel-core, kernel-tools, +29 more Red Hat Enterprise Linux 9 kernel-rt, kernel-rt-kvm, kernel-rt-core, kernel-rt-modules, kernel-rt-debug-kvm, kernel-rt-debug-core, +12 more
affected: no fix available “Fix deferred”
Red Hat CodeReady Linux Builder (v. 9) libperf 5.14.0-503.11.1.el9_5, kernel-debuginfo-common-s390x 5.14.0-503.11.1.el9_5, kernel-debuginfo-common-x86_64 5.14.0-503.11.1.el9_5, kernel-debuginfo-common-aarch64 5.14.0-503.11.1.el9_5, kernel-debuginfo-common-ppc64le 5.14.0-503.11.1.el9_5 Red Hat Enterprise Linux AppStream (v. 9) rv 5.14.0-503.11.1.el9_5, perf 5.14.0-503.11.1.el9_5, rtla 5.14.0-503.11.1.el9_5, kernel-devel-matched 5.14.0-503.11.1.el9_5, kernel-64k-devel-matched 5.14.0-503.11.1.el9_5, kernel-debug-devel-matched 5.14.0-503.11.1.el9_5, +6 more Red Hat Enterprise Linux BaseOS (v. 9) bpftool 7.4.0-503.11.1.el9_5, kernel 5.14.0-503.11.1.el9_5, kernel-64k 5.14.0-503.11.1.el9_5, kernel-core 5.14.0-503.11.1.el9_5, kernel-tools 5.14.0-503.11.1.el9_5, python3-perf 5.14.0-503.11.1.el9_5, +29 more Red Hat Enterprise Linux Real Time (v. 9) kernel-rt 5.14.0-503.11.1.el9_5, kernel-rt-core 5.14.0-503.11.1.el9_5, kernel-rt-modules 5.14.0-503.11.1.el9_5, kernel-rt-debug-core 5.14.0-503.11.1.el9_5, kernel-rt-modules-core 5.14.0-503.11.1.el9_5, kernel-rt-debug-modules 5.14.0-503.11.1.el9_5, +4 more Red Hat Enterprise Linux Real Time for NFV (v. 9) kernel-rt 5.14.0-503.11.1.el9_5, kernel-rt-kvm 5.14.0-503.11.1.el9_5, kernel-rt-core 5.14.0-503.11.1.el9_5, kernel-rt-modules 5.14.0-503.11.1.el9_5, kernel-rt-debug-kvm 5.14.0-503.11.1.el9_5, kernel-rt-debug-core 5.14.0-503.11.1.el9_5, +6 more
fixed: vendor fix RHSA-2024:9315
Red Hat CodeReady Linux Builder (v. 9) kernel-cross-headers 5.14.0-503.11.1.el9_5 Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more Red Hat Enterprise Linux AppStream (v. 9) kernel-headers 5.14.0-503.11.1.el9_5
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-26-295-16 updated 2026-10-22 cvss 6.8

Siemens SIMATIC S7-1500 TM MFP

Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem
affected: mitigation, no fix available

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-24-102-01 updated 2026-05-14 cvss 6.8

Siemens SIMATIC S7-1500 TM MFP

Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem
affected: mitigation, no fix available

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-25-226-07 updated 2026-02-25

Siemens Third-Party Components in SINEC OS

Siemens RUGGEDCOM RST2428P (6GK6242-6PA00) Siemens SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family Siemens SCALANCE XCM-/XRM-/XCH-/XRH-300 family
not affected

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-25-226-15 updated 2026-02-25 cvss 6.8

Siemens SINEC OS

Siemens RUGGEDCOM RST2428P (6GK6242-6PA00) < 3.1 Siemens SCALANCE XCM-/XRM-/XCH-/XRH-300 family < 3.1
affected: fixed in V3.1 support.industry.siemens.com
Siemens SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family
not affected

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 2 y ago (2024-09-10)

Exploit prediction

0.26% chance of exploitation in the next 30 days, higher than 17% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
NVD	3.1	5.5	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Linux Linux
Siemens RUGGEDCOM RST2428P
Siemens SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family
Siemens SCALANCE XCM-/XRM-/XCH-/XRH-300 family
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem

Classification

Weakness

CWE-476 NULL Pointer Dereference

Technology feeds

Linux kernel rss critical rss

References

Sources

CVE List CVE-2024-40945
NVD CVE-2024-40945

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary

Patch / fix

Vendor advisories

CISA SSVC

Exploit prediction

CVSS scores

Affected products

Classification

References

Sources