CVE-2024-40942 is a vulnerability identified in the Linux kernel's mac80211 wireless subsystem, specifically within the mesh networking (mesh) code. The issue involves a memory leak of mesh_preq_queue objects, which are used by the HWMP (Hybrid Wireless Mesh Protocol) code to track mesh path resolutions. When a mesh path (mpath) is deleted, such as when a mesh interface is removed, the entries in the mesh_preq_queue list are not properly cleaned up, leading to a leak of these objects. This leak was detected through Kernel Address Sanitizer (KASAN) reports showing unreferenced objects remaining allocated for extended periods. The root cause is that the mesh_path_flush_pending() function did not flush all corresponding mesh_preq_queue items when paths were deleted. The fix involves ensuring that all pending mesh_preq_queue entries are flushed appropriately during mesh path cleanup, preventing the memory leak. While the vulnerability does not appear to allow direct code execution or privilege escalation, the leak could degrade system stability over time, especially on systems heavily utilizing mesh networking features. The vulnerability affects Linux kernel versions identified by the commit hash 050ac52cbe1f3de2fb0d06f02c7919ae1f691c9e and similar builds. No known exploits are reported in the wild as of the publication date (July 12, 2024), and no CVSS score has been assigned yet.

For European organizations, the impact of CVE-2024-40942 is primarily related to system reliability and availability rather than direct compromise of confidentiality or integrity. Organizations deploying Linux-based systems with mesh networking enabled—such as in wireless infrastructure, IoT deployments, or advanced networking environments—may experience gradual memory leaks leading to resource exhaustion, degraded performance, or system crashes. This could affect critical infrastructure, enterprise wireless networks, or service provider equipment relying on Linux mesh networking. Although exploitation does not appear straightforward and requires specific mesh configurations, the vulnerability could be leveraged in targeted denial-of-service scenarios or to destabilize network nodes. European entities with extensive Linux deployments in telecommunications, public safety networks, or smart city infrastructure should be particularly aware. The leak does not require user interaction or elevated privileges to manifest but depends on mesh networking usage, which is less common in typical desktop or server environments but more prevalent in specialized wireless deployments.

To mitigate CVE-2024-40942, European organizations should: 1) Apply the latest Linux kernel patches that include the fix for this vulnerability as soon as they become available from their Linux distribution vendors or upstream kernel sources. 2) Audit and monitor systems using mesh networking features to identify any abnormal memory usage or kernel warnings related to mesh_preq_queue objects. 3) Where mesh networking is not required, disable the mac80211 mesh functionality to reduce the attack surface. 4) For critical infrastructure using mesh networks, implement proactive system resource monitoring and automated remediation to restart affected services or nodes before memory exhaustion impacts availability. 5) Engage with hardware and software vendors to ensure timely updates and validate that embedded Linux devices are patched. 6) Incorporate this vulnerability into vulnerability management and patching workflows, prioritizing systems with mesh networking enabled. 7) Consider network segmentation to isolate mesh-enabled devices from sensitive network segments to limit potential impact.