CVE-2024-40999
A critical flaw in the Linux kernel’s ena network driver could let attackers corrupt data packets. The issue was fixed by adding validation for completion descriptors. The patch prevents invalid descriptors from causing a reset.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux kernel, specifically the ena network driver. Users running older kernel versions that lack the descriptor validation fix are affected.
Real-world impact
An attacker could send specially crafted packets that trigger a kernel reset or cause data corruption, potentially leading to denial of service or other malicious outcomes.
Why this severity
The CVSS score of 9.8 reflects the vulnerability’s high impact (complete confidentiality, integrity, and availability loss) and its ease of exploitation over the network with no authentication or user interaction required.
What to do about it
- 01Upgrade your Linux kernel to a version that includes the ena driver fix for descriptor validation.
- 02Reboot the system to load the updated kernel.
NVD description
Timeline
- Jul 12, 2024 · Jul 12, 2024PublishedDisclosed and added to the National Vulnerability Database.
- Aug 4, 2026 · 2d agoAdvisory updatedThe NVD record was last revised.
- Aug 5, 2026 · 1d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.