CVE-2024-40983
A flaw in the Linux kernel’s TIPC decryption path can cause the system to crash. The issue occurs when a crypto request is asynchronous and the destination reference count is not forced before decryption. The bug has been fixed in a recent kernel commit.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux kernel, especially versions 6.10 and earlier that do not include the recent patch.
Real-world impact
An attacker could trigger a crash of the kernel, leading to a denial‑of‑service condition on the affected system.
Why this severity
The CVSS score of 9.8 reflects that the vulnerability can completely compromise confidentiality, integrity, and availability. It requires no authentication or user interaction, making it highly dangerous.
What to do about it
- 01Check your current kernel version with `uname -r`.
- 02If your kernel is older than the version that includes commit 3bc07321ccc2, upgrade to a newer kernel release (e.g., the latest 6.10.x or later).
- 03Reboot the system so the updated kernel takes effect.
NVD-referenced vendor advisory
Timeline
- Jul 12, 2024 · Jul 12, 2024PublishedDisclosed and added to the National Vulnerability Database.
- Aug 4, 2026 · 2d agoAdvisory updatedThe NVD record was last revised.
- Aug 5, 2026 · 1d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
How it’s attacked
References & advisories
- git.kernel.org/stable/c/2ebe8f840c7450ecbf…patch
- git.kernel.org/stable/c/3eb1b39627892c4e26…patch
- git.kernel.org/stable/c/623c90d86a61e3780f…patch
- git.kernel.org/stable/c/6808b41371670c51fe…patch
- git.kernel.org/stable/c/692803b39a36e63ac7…patch
- git.kernel.org/stable/c/b57a4a2dc8746cea58…patch
- lists.debian.org/debian-lts-announce/2025/01…