{"cve":"CVE-2024-40913","nvd":{"published":"2024-07-12T13:15:14.457","modified":"2026-06-17T07:46:51.360","status":"Modified","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ncachefiles: defer exposing anon_fd until after copy_to_user() succeeds\n\nAfter installing the anonymous fd, we can now see it in userland and close\nit. However, at this point we may not have gotten the reference count of\nthe cache, but we will put it during colse fd, so this may cause a cache\nUAF.\n\nSo grab the cache reference count before fd_install(). In addition, by\nkernel convention, fd is taken over by the user land after fd_install(),\nand the kernel should not call close_fd() after that, i.e., it should call\nfd_install() after everything is ready, thus fd_install() is called after\ncopy_to_user() succeeds.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8},"cwes":["CWE-416"],"references":["https://git.kernel.org/stable/c/4b4391e77a6bf24cba2ef1590e113d9b73b11039","https://git.kernel.org/stable/c/b9f58cdae6a364a3270fd6b6a46e0fd4f7f8ce32","https://git.kernel.org/stable/c/d2d3eb377a5d081bf2bed177d354a4f59b74da88","https://git.kernel.org/stable/c/eac51d9daacd61dcc93333ff6a890cf3efc8c1c0","https://git.kernel.org/stable/c/4b4391e77a6bf24cba2ef1590e113d9b73b11039"],"products":["linux:linux_kernel"],"source":"nvd","synced_at":"2026-10-19T21:52:42.518321223+00:00"},"epss":{"cve":"CVE-2024-40913","score":0.00287,"percentile":0.21292,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}