Answer in brief
CVE-2024-40937 records a Unknown severity vulnerability in gve: Clear napi->skb before dev_kfree_skb_any(). The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=9b8dd5e5ea48bbb7532d20c4093a79d8283e4029 <75afd8724739ee5ed8165acde5f6ac3988b485cc || >=9b8dd5e5ea48bbb7532d20c4093a79d8283e4029 <d221284991118c0ab16480b53baecd857c0bc442 || >=9b8dd5e5ea48bbb7532d20c4093a79d8283e4029 <2ce5341c36993b776012601921d7688693f8c037 || >=9b8dd5e5ea48bbb7532d20c4093a79d8283e4029 <a68184d5b420ea4fc7e6b7ceb52bbc66f90d3c50 || >=9b8dd5e5ea48bbb7532d20c4093a79d8283e4029 <6f4d93b78ade0a4c2cafd587f7b429ce95abb02e | 75afd8724739ee5ed8165acde5f6ac3988b485cc, d221284991118c0ab16480b53baecd857c0bc442, 2ce5341c36993b776012601921d7688693f8c037, a68184d5b420ea4fc7e6b7ceb52bbc66f90d3c50, 6f4d93b78ade0a4c2cafd587f7b429ce95abb02e |
| Linux/Linuxgeneric | 5.14 | Not reported |
Published upstream
Jul 12, 2024
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 5, 2026
In the Linux kernel, the following vulnerability has been resolved: gve: Clear napi->skb before dev_kfree_skb_any() gve_rx_free_skb incorrectly leaves napi->skb referencing an skb after it is freed with dev_kfree_skb_any(). This can result in a subsequent call to napi_get_frags returning a dangling pointer. Fix this by clearing napi->skb before the skb is freed.
Quoted source text, attributed separately from HOL analysis.
Answer in brief
CVE-2024-40937 records a Unknown severity vulnerability in gve: Clear napi->skb before dev_kfree_skb_any(). The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=9b8dd5e5ea48bbb7532d20c4093a79d8283e4029 <75afd8724739ee5ed8165acde5f6ac3988b485cc || >=9b8dd5e5ea48bbb7532d20c4093a79d8283e4029 <d221284991118c0ab16480b53baecd857c0bc442 || >=9b8dd5e5ea48bbb7532d20c4093a79d8283e4029 <2ce5341c36993b776012601921d7688693f8c037 || >=9b8dd5e5ea48bbb7532d20c4093a79d8283e4029 <a68184d5b420ea4fc7e6b7ceb52bbc66f90d3c50 || >=9b8dd5e5ea48bbb7532d20c4093a79d8283e4029 <6f4d93b78ade0a4c2cafd587f7b429ce95abb02e | 75afd8724739ee5ed8165acde5f6ac3988b485cc, d221284991118c0ab16480b53baecd857c0bc442, 2ce5341c36993b776012601921d7688693f8c037, a68184d5b420ea4fc7e6b7ceb52bbc66f90d3c50, 6f4d93b78ade0a4c2cafd587f7b429ce95abb02e |
| Linux/Linuxgeneric | 5.14 | Not reported |
Published upstream
Jul 12, 2024
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 5, 2026
In the Linux kernel, the following vulnerability has been resolved: gve: Clear napi->skb before dev_kfree_skb_any() gve_rx_free_skb incorrectly leaves napi->skb referencing an skb after it is freed with dev_kfree_skb_any(). This can result in a subsequent call to napi_get_frags returning a dangling pointer. Fix this by clearing napi->skb before the skb is freed.
Quoted source text, attributed separately from HOL analysis.