This is grandfathered in

The NEC, up until reasonably recently, did not require an equipment grounding conductor in a feeder to an outbuilding, treating it by analogy to a service, where the fault path is through the neutral. This is problematic from a shock risk perspective if the feeder neutral opens, though, which is why the Code was recently changed to require all feeders to carry an equipment grounding conductor with them.

As you are dealing with an existing install though, the NEC explicitly grandfathers the three-wire feeder to an outbuilding in via 250.32(B)(1) Exception 1:

Exception No.1: For installations made in compliance with previous editions of this Code that permitted such connection, the grounded conductor run with the supply to the building or structure shall be permitted to serve as the ground-fault return path if all of the following requirements continue to be met:

(1) An equipment grounding conductor is not run with the supply to the building or structure.

(2) There are no continuous metallic paths bonded to the grounding system in each building or structure involved.

(3) Ground-fault protection of equipment has not been installed on the supply side of the feeder(s).

If the grounded conductor is used for grounding in accordance with the provision of this exception, the size of the grounded conductor shall not be smaller than the larger of either of the following:

(1) That required by 220.61

(2) That required by 250.122

Changing it would be a good idea, but...

The 2014 NEC introduced a provision in 250.130(C) that allowed branch circuits to be grounded by tapping off of other EGCs. This is handy for branch circuit retrofits, but sadly, does not apply to feeders; nor can you run the ground wire separately, as it reverts to 250.32(B)(1)'s verbiage which prohibits that.

This leaves you with three options. The cheapest and simplest one is to install a GFCI breaker in-line with the feeder at the garage end. This can get tricky though, as many small subpanels rely on a backfed main breaker, and you cannot backfeed GFCI breakers -- you'll fry the GFCI's trip solenoid if you try it. Your best bet is to mount a unit mount/cable-in cable-out GFCI breaker in a single-breaker disconnect box and wire it up so that the feeder comes into LINE, and a short 4-wire feeder jumper connects LOAD on the breaker to the subpanel's main lugs.

You'll also need to unbond the subpanel, install a ground bar in it, and move the GEC over to be commoned with the LINE-side neutral of the GFCI via the disconnect box's neutral bar, which serves as the neutral/ground bond for the garage.

Making this a real service

An alternative is to snag a dry-type distribution transformer (5 kVA is a common size for this type of application, but might be slightly small for your 40A feeder) and install it at the outbuilding, creating a separately derived system. The primary needs to be jumpered for 240V and connected to the feeder hots with the feeder neutral capped off as it's useless now, while the secondary is jumpered for 240V as well and feeds the existing garage panel, which is now a main panel from the Code's point of view.

While this sounds costly, transformers sometimes turn up used for reasonable prices -- they are fairly heavy critters though, so it's probably best to check Craigslist to see if one is coming out of a building demolition/remodel job or something like that in your area.

Redoing it

Of course, you can simply re-run the feeder as well, which will let you incorporate an equipment grounding conductor -- this is practical for a short feeder like yours, but can get costly for long feeders.