CVE-2024-40936: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-40936 affects the Linux kernel's CXL (Compute Express Link) region handling functionality. The vulnerability was discovered in the devm_cxl_add_region() function where memory region leaks could occur due to improper mode verification timing. The issue affects Linux kernel versions from 6.3 up to versions before 6.6.35, from 6.7 up to versions before 6.9.6, and release candidates 6.10-rc1 and 6.10-rc2 (NVD).

The vulnerability stems from a memory leak in the CXL subsystem's region handling code. Specifically, the mode verification in devm_cxl_add_region() was performed after allocating memory regions, which could lead to resource leaks when invalid modes were detected. The issue has a CVSS v3.1 base score of 5.5 (Medium) with vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, indicating local access requirements and potential high impact on availability (NVD).

The vulnerability can result in memory leaks in the Linux kernel's CXL subsystem when handling region allocations. This could lead to resource exhaustion and potential system instability over time. The impact is primarily focused on availability, with no direct impact on confidentiality or integrity (NVD).

The vulnerability requires local access with low complexity and low privileges to exploit. No user interaction is needed for exploitation. There are no known reports of this vulnerability being exploited in the wild (NVD).

The vulnerability has been fixed by moving the mode verification to __create_region() before allocating the memregion. The fix is available in the Linux kernel through commit 49ba7b515c4c. Users should upgrade to Linux kernel versions 6.6.35 or later, 6.9.6 or later, or apply the available patches (Kernel Patch).