Security readout for executives and security teams
Plain-English summary
Linux can mishandle an internal reference when a modular persistent-storage backend is unloaded while records remain in pstorefs. The documented symptom is a kernel warning, while the supplied CVSS assessment models potentially serious system impact. Exploitation requires local access, and exposure depends on specific pstore configuration and module activity; this is not described as a remote vulnerability.
Executive priority
Prioritize remediation on sensitive or multi-user hosts where pstorefs and unloadable pstore backends are present. Systems without that configuration should still be validated and updated through accelerated kernel maintenance, but the sources do not support treating this as an emergency internet-facing threat.
Technical view
The pstore inode cleanup path used d_drop() followed by dput(), causing a double reference drop when unloading a modular backend containing pstorefs records. The fix replaces this sequence with d_invalidate(). CVSS 3.1 scores it 7.8: local access, low complexity, low privileges, no interaction, unchanged scope, and high modeled confidentiality, integrity, and availability impacts.
Likely exposure
Likely exposure is limited to systems using affected Linux kernels, pstorefs, and an unloadable modular pstore backend with records present. Listed affected entries include 5.8, 5.15.209, 6.1.83, 6.6.23, 6.7.11, 6.8.2, and 6.9. Distribution package and backport status are not supplied.
Exploitation context
The bundle marks this CVE as absent from KEV, and no cited source reports active exploitation or public weaponization. The CVSS vector models a local, low-privileged attack, but the supplied description does not establish the precise attacker-controlled path or demonstrate exploitation beyond the reference-counting warning.
Researcher notes
The sources establish a dentry reference-counting defect and document a dput double-drop warning. They do not describe a proven exploitation primitive, reliable security outcome, affected distribution packages, or public proof of concept. The kernel.org references provide stable-branch fixes; vendor backports should be checked for equivalent code changes.
Mitigation direction
- Install a vendor-supported kernel containing the applicable stable fix or an equivalent backport.
- Check distribution guidance for the exact fixed package; upstream version data does not establish vendor backport status.
- Until updated, avoid unloading modular pstore backends while pstorefs retains records, where operationally safe.
Validation and detection
- Inventory kernel versions and compare installed packages with current distribution security guidance.
- Determine whether pstorefs is used and whether its active backend is modular and unloadable.
- Verify the installed kernel contains a referenced stable fix or an equivalent vendor backport.
- Review kernel logs for dput double-drop warnings associated with pstore backend unloading.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-27389 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/d0ee2a8adb6673382cce8a4280e1ca0849b3b783CVE reference, Linux
- https://git.kernel.org/stable/c/db6e5e16f1ee9e3b01d2f71c7f0ba945f4bf0f4eCVE reference, Linux
- https://git.kernel.org/stable/c/4cdf9006fc095af71da80e9b5f48a32e991b9ed3CVE reference, Linux
- https://git.kernel.org/stable/c/cb9e802e49c24eeb3af35e9e8c04d526f35f112aCVE reference, Linux
- https://git.kernel.org/stable/c/340682ed1932b8e3bd0bfc6c31a0c6354eb57cc6CVE reference, Linux
- https://git.kernel.org/stable/c/a43e0fc5e9134a46515de2f2f8d4100b74e50de3CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.