What is CVE-2024-40902?

CVE-2024-40902 is a High severity Linux kernel vulnerability with a CVSS score of 7.8 out of 10, affecting Linux kernel versions from 2.6.12 onward and patched in 4.19.317, 5.4.279, 5.10.221 and others. CVE-2024-40902 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

What is the CVSS score for CVE-2024-40902?

CVE-2024-40902 has a CVSS score of 7.8 out of 10, rated High severity. The vector string is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Is there a patch available for CVE-2024-40902?

Yes, CVE-2024-40902 has been patched. Fixed versions include 4.19.317, 5.4.279, 5.10.221 and others. If you are running Linux kernel 2.6.12 or later up to the fix versions, apply the relevant patch for your kernel branch.

Is CVE-2024-40902 actively exploited?

CVE-2024-40902 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

CVE-2024-40902

High

In the Linux kernel, the following vulnerability has been resolved: jfs: xattr: fix buffer overflow for invalid xattr When an xattr size is not what is expected, it is printed out to the kernel log in hex format as a form of debugging. But when that xattr size is bigger than the expected size, printing it out can cause an access off the end of the buffer. Fix this all up by properly restricting the size of the debug hex dump in the kernel log.

Package Linux Kernel

Published 2024-07-12

Last modified 2025-11-03

CVSS version 3.1

Patch available

Yes

CVSS 3.1 score

7.8

out of 10

High

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Vector string

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness type

CWE-120

CVE-2024-40902 is classified as CWE-120

See CWE-120 on MITRE CWE for full details on this weakness type.

Affected versions

Linux kernel versions 2.6.12 and later are affected. Fixed in 4.19.317, 5.4.279, 5.10.221, 5.15.162, 6.1.95, 6.6.35, 6.9.6, 6.10 and their respective stable series.

Affected from

≥ 2.6.12

Fixed in

✓ 4.19.317 4.19.x ✓ 5.4.279 5.4.x ✓ 5.10.221 5.10.x ✓ 5.15.162 5.15.x ✓ 6.1.95 6.1.x ✓ 6.6.35 6.6.x ✓ 6.9.6 6.9.x ✓ 6.10

References

9 total

Kernel Git
https://git.kernel.org/stable/c/1e84c9b1838152a87cf453270a5fa75c5037e83a

Patch
Kernel Git
https://git.kernel.org/stable/c/33aecc5799c93d3ee02f853cb94e201f9731f123

Patch
Kernel Git
https://git.kernel.org/stable/c/4598233d9748fe4db4e13b9f473588aa25e87d69

Patch
Kernel Git
https://git.kernel.org/stable/c/480e5bc21f2c42d90c2c16045d64d824dcdd5ec7

Patch
Kernel Git
https://git.kernel.org/stable/c/7c55b78818cfb732680c4a72ab270cc2d2ee3d0f

Patch

Showing 5 of 9 references View all on NVD

Details

CVE ID CVE-2024-40902

Severity High

CVSS score 7.8 / 10

CVSS version 3.1

Published 2024-07-12

Modified 2025-11-03

KEV No

Patch

Yes

Package linux

Frequently asked questions

What is CVE-2024-40902?

CVE-2024-40902 is a High severity Linux kernel vulnerability with a CVSS score of 7.8 out of 10 . It affects Linux kernel versions from 2.6.12 onward and has been patched in 4.19.317, 5.4.279, 5.10.221 and others. CVE-2024-40902 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
What is the CVSS score for CVE-2024-40902?

CVE-2024-40902 has a CVSS score of 7.8 out of 10, rated High severity (CVSS 3.1). The vector string is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Is there a patch available for CVE-2024-40902?

Yes. CVE-2024-40902 has been patched. Fixed versions include 4.19.317, 5.4.279, 5.10.221 and others. If you are running Linux kernel 2.6.12 or later up to the fix versions, apply the relevant patch for your kernel branch.
Is CVE-2024-40902 actively exploited?

No. CVE-2024-40902 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.