Answer in brief
CVE-2024-40910 records a High severity (CVSS 8.8) vulnerability in ax25: Fix refcount imbalance on inbound connections. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 8.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=9fd75b66b8f68498454d685dc4ba13192ae069b0 <f4df9d6c8d4e4c818252b0419c2165d66eabd4eb || >=9fd75b66b8f68498454d685dc4ba13192ae069b0 <52100fd74ad07b53a4666feafff1cd11436362d3 || >=9fd75b66b8f68498454d685dc4ba13192ae069b0 <a723a6c8d4831cc8e2c7b0c9f3f0c010d4671964 || >=9fd75b66b8f68498454d685dc4ba13192ae069b0 <3c34fb0bd4a4237592c5ecb5b2e2531900c55774 || c44a453ffe16eb08acdc6129ac4fa0192dbc0456 || de55a1338e6a48ff1e41ea8db1432496fbe2a62b || 9e1e088a57c23251f1cfe9601bbd90ade2ea73b9 || b20a5ab0f5fb175750c6bafd4cf12daccf00c738 || 452ae92b99062d2f6a34324eaf705a3b7eac9f8b || 534156dd4ed768e30a43de0036f45dca7c54818f || >=4.14.277 <4.15 || >=4.19.240 <4.20 || >=5.4.190 <5.5 || >=5.10.112 <5.11 || >=5.15.35 <5.16 || >=5.17.2 <5.18 | f4df9d6c8d4e4c818252b0419c2165d66eabd4eb, 52100fd74ad07b53a4666feafff1cd11436362d3, a723a6c8d4831cc8e2c7b0c9f3f0c010d4671964, 3c34fb0bd4a4237592c5ecb5b2e2531900c55774, 4.15, 4.20, 5.5, 5.11, 5.16, 5.18 |
| Linux/Linuxgeneric | 5.18 | Not reported |
Published upstream
Jul 12, 2024
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 5, 2026
In the Linux kernel, the following vulnerability has been resolved: ax25: Fix refcount imbalance on inbound connections When releasing a socket in ax25_release(), we call netdev_put() to decrease the refcount on the associated ax.25 device. However, the execution path for accepting an incoming connection never calls netdev_hold(). This imbalance leads to refcount errors, and ultimately to kernel crashes. A typical call trace for the above situation will start with one of the following errors: refcount_t: decrement hit 0; leaking memory. refcount_t: underflow; use-after-free. And will then have a trace like: Call Trace: <TASK> ? show_regs+0x64/0x70 ? __warn+0x83/0x120 ? refcount_warn_saturate+0xb2/0x100 ? report_bug+0x158/0x190 ? prb_read_valid+0x20/0x30 ? handle_bug+0x3e/0x70 ? exc_invalid_op+0x1c/0x70 ? asm_exc_invalid_op+0x1f/0x30 ? refcount_warn_saturate+0xb2/0x100 ? refcount_warn_saturate+0xb2/0x100 ax25_release+0x2ad/0x360 __sock_release+0x35/0xa0 sock_close+0x19/0x20 [...] On reboot (or any attempt to remove the interface), the kernel gets stuck in an infinite loop: unregister_netdevice: waiting for ax0 to become free. Usage count = 0 This patch corrects these issues by ensuring that we call netdev_hold() and ax25_dev_hold() for new connections in ax25_accept(). This makes the logic leading to ax25_accept() match the logic for ax25_bind(): in both cases we increment the refcount, which is ultimately decremented in ax25_release().
Quoted source text, attributed separately from HOL analysis.