VYPR
← All advisories
Medium severity5.5NVD Advisory· Published Jul 12, 2024· Updated May 12, 2026

CVE-2024-40941

CVE-2024-40941

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: iwlwifi: mvm: don't read past the mfuart notifcation

In case the firmware sends a notification that claims it has more data than it has, we will read past that was allocated for the notification. Remove the print of the buffer, we won't see it by default. If needed, we can see the content with tracing.

This was reported by KFENCE.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

In the Linux kernel's iwlwifi driver, a crafted firmware notification with a claimed length larger than allocated causes an out-of-bounds read, reported by KFENCE.

Vulnerability

CVE-2024-40941 is a buffer over-read vulnerability in the iwlwifi WiFi driver of the Linux kernel. The issue occurs in the mvm (mac80211-based) component when parsing a firmware notification (mfuart). If the firmware sends a notification that claims to have more data than was actually allocated, the driver will read beyond the allocated buffer, leading to an out-of-bounds read [3].

Exploitation

An attacker with the ability to influence or spoof firmware messages directed at the iwlwifi driver can trigger this vulnerability. The attack is local in terms of the driver context, but the firmware notification is received through the WiFi hardware. No special privileges are required beyond normal WiFi access. The bug was discovered by KFENCE, a kernel memory debugging tool, indicating it can cause detectable memory access violations [1].

Impact

Successful exploitation could allow an attacker to read kernel memory beyond the bounds of the allocated buffer, potentially leaking sensitive information. The CVSS v3 base score is 5.5 (Medium) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, indicating high confidentiality impact but no impact on integrity or availability. However, the official description notes that the erroneous print of the buffer was removed, and tracing can be used for debugging instead.

Mitigation

The fix for this vulnerability is included in the Linux kernel stable tree through commits [3] and [4]. Users should update their kernel to a version containing these patches. Siemens also lists this CVE in their product security advisory SSA-265688 [2], impacting SIMATIC S7-1500 TM MFP - GNU/Linux subsystem all versions, requiring remediation from Siemens.

References
  1. SSA-355557
  2. SSA-265688
  3. Making sure you're not a bot!
  4. Making sure you're not a bot!

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

184

Patches

8
65686118845d
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.gitvia osv
commit
46c59a253370
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.gitvia osv
commit
6532f18e66b3
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.gitvia osv
commit
15b37c6fab9d
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.gitvia osv
commit
4bb95f453548
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.gitvia osv
commit
acdfa33c3cf5
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.gitvia osv
commit
a05018739a5e
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.gitvia osv
commit
a8bc8276af9a
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.gitvia osv
commit

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

11

News mentions

0

No linked articles in our index yet.