CVE-2024-40978 – This CVE describes a kernel crash vulnerability... (How to Fix)

Q: What is the severity of CVE-2024-40978?

CVE-2024-40978 has a CVSS score of 7.1 (HIGH). This CVE describes a kernel crash vulnerability in the Linux kernel's QLogic QEDI iSCSI driver. The vulnerability occurs when reading debugfs attributes, where the driver incorrectly uses sprintf() directly on a user-space pointer, causing a page fault and kernel crash. Systems using the qedi driver with debugfs enabled are affected.

📋 TL;DR

This CVE describes a kernel crash vulnerability in the Linux kernel's QLogic QEDI iSCSI driver. The vulnerability occurs when reading debugfs attributes, where the driver incorrectly uses sprintf() directly on a user-space pointer, causing a page fault and kernel crash. Systems using the qedi driver with debugfs enabled are affected.

💻 Affected Systems

Products:

Linux kernel with qedi driver

Versions: Linux kernel versions before the fix commits (specific versions vary by distribution)

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ✅ No

Notes: Only vulnerable when qedi driver is loaded and debugfs is mounted/accessible. Many systems don't use qedi by default.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic leading to system crash and denial of service, potentially causing data loss or service disruption.

🟠

Likely Case

Local denial of service through kernel crash when accessing debugfs attributes.

🟢

If Mitigated

No impact if debugfs is disabled or the qedi module is not loaded.

🌐 Internet-Facing: LOW - Requires local access to debugfs interface.

🏢 Internal Only: MEDIUM - Local users or processes with debugfs access can crash the kernel.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploitation requires local access to debugfs interface. The crash is triggered by reading specific debugfs files.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Fixed in kernel commits: 144d76a676b630e321556965011b00e2de0b40a7, 21c963de2e86e88f6a8ca556bcebb8e62ab8e901, 28027ec8e32ecbadcd67623edb290dad61e735b5, 397a8990c377ee4b61d6df768e61dff9e316d46b, 56bec63a7fc87ad50b3373a87517dc9770eef9e0

Vendor Advisory: https://git.kernel.org/stable/c/144d76a676b630e321556965011b00e2de0b40a7

Restart Required: Yes

Instructions:

1. Update to a kernel version containing the fix commits. 2. Check your distribution's security advisories for specific patched versions. 3. Reboot after kernel update.

🔧 Temporary Workarounds

Disable debugfs

linux

Unmount debugfs filesystem to prevent access to vulnerable interface

umount /sys/kernel/debug

Unload qedi module

linux

Remove the vulnerable driver if not needed

modprobe -r qedi

🧯 If You Can't Patch

Restrict debugfs access to root only using mount options
Implement strict access controls on /sys/kernel/debug directory

🔍 How to Verify

Check if Vulnerable:

Check if qedi module is loaded: lsmod | grep qedi. Check kernel version against patched versions.

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version includes fix commits. Test reading debugfs qedi attributes doesn't crash.

📡 Detection & Monitoring

Log Indicators:

Kernel panic logs mentioning qedi_dbg_do_not_recover_cmd_read
Page fault errors in kernel logs with qedi references

Network Indicators:

None - local vulnerability only

SIEM Query:

source="kernel" AND ("qedi" OR "page fault" OR "Oops")

📊 Metadata

CVE ID: CVE-2024-40978

CVSS v3 Score: 7.1 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

CWE: CWE-125

Published: July 12, 2024

Last Updated: November 3, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-40978, you might also want to check these: