7.8

CVE-2024-40984: linux NULL Pointer Dereference

CVSS: 7.8v3.1HighModified
AliasesUBUNTU-CVE-2024-40984DEBIAN-CVE-2024-40984
Published 12-07-2024Last modified 15-10-2026
Open JSON

Vulnerability summary

CVE-2024-40984 is a high (CVSS 7.8) NULL Pointer Dereference vulnerability in linux. EPSS estimates a 0.30% chance of exploitation in the next 30 days, higher than 21.2% of scored vulnerabilities.

Overall risk
31/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.8/10
010
High · v3.1 (CVE.org)
EPSS score
0.30%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 40 · Related 30
DLA-4008-1DSA-5730-1DSA-5731-1RHSA-2024:6744RHSA-2024:6745RHSA-2024:6990

Timeline

  1. 12-07-2024
    PublishedVulnerability first disclosed.
  2. 15-10-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine." Undo the modifications made in commit d410ee5109a1 ("ACPICA: avoid "Info: mapping multiple BARs. Your kernel is fine.""). The initial purpose of this commit was to stop memory mappings for operation regions from overlapping page boundaries, as it can trigger warnings if different page attributes are present. However, it was found that when this situation arises, mapping continues until the boundary's end, but there is still an attempt to read/write the entire length of the map, leading to a NULL pointer deference. For example, if a four-byte mapping request is made but only one byte is mapped because it hits the current page boundary's end, a four-byte read/write attempt is still made, resulting in a NULL pointer deference. Instead, map the entire length, as the ACPI specification does not mandate that it must be within the same page boundary. It is permissible for it to be mapped across different regions.

CVSS metrics

4 scores · 4 sources · 1 version

EPSS trend

Probability

0.30%

Chance of exploitation in the next 30 days

Percentile

21%

Versus all other CVEs

30-day change

0.00 pp

From 0.30% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.30%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Ubuntu128 products
  • linuxAll versions (No fix recorded) | < 5.4.0-195.215 | < 5.15.0-121.131 | < 6.8.0-44.44
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded) | < 5.4.0-1132.142 | < 5.15.0-1069.75 | < 6.8.0-1015.16
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Linux2 products
  • linux≥ d410ee5109a1633a686a5663c6743a92e1181f9b, < 435ecc978c3d5d0c4e172ec5b956dc1904061d98 | ≥ d410ee5109a1633a686a5663c6743a92e1181f9b, < ae465109d82f4fb03c5adbe85f2d6a6a3d59124c | ≥ d410ee5109a1633a686a5663c6743a92e1181f9b, < 6eca23100e9030725f69c1babacd58803f29ec8d | ≥ d410ee5109a1633a686a5663c6743a92e1181f9b, < dc5017c57f5eee80020c73ff8b67ba7f9fd08b1f | ≥ d410ee5109a1633a686a5663c6743a92e1181f9b, < ddc1f5f124479360a1fd43f73be950781d172239 | ≥ d410ee5109a1633a686a5663c6743a92e1181f9b, < 434c6b924e1f4c219aab2d9e05fe79c5364e37d3 | ≥ d410ee5109a1633a686a5663c6743a92e1181f9b, < e21a4c9129c72fa54dd00f5ebf71219b41d43c04 | ≥ d410ee5109a1633a686a5663c6743a92e1181f9b, < a83e1385b780d41307433ddbc86e3c528db031f0 | 2.6.32
  • linux_kernel≥ 2.6.32, < 4.19.317 | ≥ 4.20, < 5.4.279 | ≥ 5.5, < 5.10.221 | ≥ 5.11, < 5.15.162 | ≥ 5.16, < 6.1.96 | ≥ 6.2, < 6.6.36 | ≥ 6.7, < 6.9.7 | 6.10:rc1 | 6.10:rc2 | 6.10:rc3 | 6.10:rc4
Debian1 product
  • linux< 6.1.99-1 | < 6.9.7-1

3 vendors · 131 products

References

35 links
Show all 35 references