CVE-2024-40910: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-40910 is a vulnerability in the Linux kernel's AX.25 protocol implementation, discovered in July 2024. The issue involves a refcount imbalance in the ax25_accept() function where netdev_hold() is not called for incoming connections, while netdev_put() is called during socket release in ax25_release(). This vulnerability affects Linux kernel versions from 5.18 up to 6.1.95, 6.2 to 6.6.35, 6.7 to 6.9.6, and 6.10-rc1/rc2 (NVD).

The vulnerability stems from a refcount imbalance in the AX.25 protocol implementation. When releasing a socket in ax25_release(), the code calls netdev_put() to decrease the refcount on the associated AX.25 device. However, the execution path for accepting an incoming connection never calls netdev_hold(), creating an imbalance. This leads to refcount errors that manifest as either 'refcount_t: decrement hit 0; leaking memory' or 'refcount_t: underflow; use-after-free' errors. The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (Medium) with vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD, Kernel Patch).

The vulnerability can lead to kernel crashes and system instability. When attempting to reboot or remove the interface, the kernel can become stuck in an infinite loop with the message 'unregister_netdevice: waiting for ax0 to become free. Usage count = 0'. This primarily affects system availability and stability, with no direct impact on confidentiality or integrity (Kernel Patch).

The vulnerability requires local access and can be triggered through normal usage of AX.25 networking functionality. The issue specifically occurs during the handling of inbound connections, making it exploitable in environments where AX.25 protocol communications are active (NVD).

The issue has been patched by ensuring that netdev_hold() and ax25_dev_hold() are called for new connections in ax25_accept(). This makes the logic consistent with ax25_bind(), where the refcount is incremented and later decremented in ax25_release(). The fix has been incorporated into various Linux distributions, including Ubuntu and Debian, through their respective security updates (Ubuntu Notice, Debian Notice).