---
id: CVE-2024-40945
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  iommu: Return right value in iommu_sva_bind_device()

  iommu_sva_bind_device() should return either a sva bond handle or an
  ERR_PTR value in error cases
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  iommu: Return right value in iommu_sva_bind_device()

  iommu_sva_bind_device() should return either a sva bond handle or an
  ERR_PTR value in error cases. Existing driver…
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-476
vendor: linux
product: linux_kernel
affected:
  - 'linux_kernel >= 5.2, < 5.4.279'
  - 'linux_kernel >= 5.5, < 5.10.221'
  - 'linux_kernel >= 5.11, < 5.15.162'
  - 'linux_kernel >= 5.16, < 6.6.35'
  - 'linux_kernel >= 6.7, < 6.9.6'
  - linux_kernel = 6.10
patched:
  - linux_kernel 6.9.6
published: '2024-07-12'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T01:18:38.130'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2024-40945'
references:
  - url: 'https://git.kernel.org/stable/c/2973b8e7d127754de9013177c41c0b5547406998'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/61a96da9649a6b6a1a5d5bde9374b045fdb5c12e'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/6325eab6c108fed27f60ff51852e3eac0ba23f3f'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/700f564758882db7c039dfba9443fe762561a3f8'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/7388ae6f26c0ba95f70cc96bf9c5d5cb06c908b6'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/89e8a2366e3bce584b6c01549d5019c5cda1205e'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/cf34f8f66982a36e5cba0d05781b21ec9606b91e'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/2973b8e7d127754de9013177c41c0b5547406998'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://git.kernel.org/stable/c/61a96da9649a6b6a1a5d5bde9374b045fdb5c12e'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://git.kernel.org/stable/c/700f564758882db7c039dfba9443fe762561a3f8'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://git.kernel.org/stable/c/7388ae6f26c0ba95f70cc96bf9c5d5cb06c908b6'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://git.kernel.org/stable/c/89e8a2366e3bce584b6c01549d5019c5cda1205e'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://git.kernel.org/stable/c/cf34f8f66982a36e5cba0d05781b21ec9606b91e'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://lists.debian.org/debian-lts-announce/2025/03/msg00028.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-265688.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-355557.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-613116.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-784472.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
tags:
  - nvd
  - cve.org
epss: 0.00257
epssPercentile: 0.164
ingestedAt: '2026-10-15T03:30:12.721Z'
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2024-09-10T17:04:14.417698Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

iommu: Return right value in iommu_sva_bind_device()

iommu_sva_bind_device() should return either a sva bond handle or an
ERR_PTR value in error cases. Existing drivers (idxd and uacce) only
check the return value with IS_ERR(). This could potentially lead to
a kernel NULL pointer dereference issue if the function returns NULL
instead of an error pointer.

In reality, this doesn't cause any problems because iommu_sva_bind_device()
only returns NULL when the kernel is not configured with CONFIG_IOMMU_SVA.
In this case, iommu_dev_enable_feature(dev, IOMMU_DEV_FEAT_SVA) will
return an error, and the device drivers won't call iommu_sva_bind_device()
at all.

## Affected

- `linux_kernel >= 5.2, < 5.4.279`
- `linux_kernel >= 5.5, < 5.10.221`
- `linux_kernel >= 5.11, < 5.15.162`
- `linux_kernel >= 5.16, < 6.6.35`
- `linux_kernel >= 6.7, < 6.9.6`
- `linux_kernel = 6.10`

## Remediation

Upgrade past the affected range:

- `linux_kernel 6.9.6`