CVE-2024-40907
A bug in the Linux kernel’s ionic network driver can cause a kernel panic when packets are transmitted, leading to a system crash. The issue occurs because a freed memory page is reused without being cleared. The vulnerability has been fixed in newer kernel releases.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux kernel users running versions that include the ionic driver, particularly kernel 6.9 and earlier. Any system that has not yet applied the patch is vulnerable.
Real-world impact
An attacker could trigger a kernel panic, causing the affected system to crash and become unavailable. This results in a denial‑of‑service for the host and any services running on it.
Why this severity
The CVSS score of 9.8 reflects that the flaw can be exploited remotely (network access) with no authentication or user interaction, and it completely compromises confidentiality, integrity, and availability. The low attack complexity and lack of required privileges make it highly dangerous.
What to do about it
- 01Upgrade the Linux kernel to a version that includes the ionic driver fix (e.g., kernel 6.10 or later).
- 02Reboot the system to load the updated kernel.
NVD description indicates the vulnerability has been resolved in the kernel.
Timeline
- Jul 12, 2024 · Jul 12, 2024PublishedDisclosed and added to the National Vulnerability Database.
- Aug 4, 2026 · 2d agoAdvisory updatedThe NVD record was last revised.
- Aug 5, 2026 · 1d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.