Security readout for executives and security teams
Plain-English summary
This is a high-severity Linux kernel flaw in x86 floating-point state handling. Under specific local conditions, cached CPU state can drift from the real processor register state after CPU hotplug, leading to a kernel-space fault and system crash.
Executive priority
Treat as a timely kernel patching priority for exposed Linux servers and workstations. Business urgency is higher where local multi-user access, shared compute, or untrusted workloads are present. No source in the bundle proves active exploitation.
Technical view
The issue affects x86 FPU XFD state tracking. CPU hotplug resets MSR_IA32_XFD, but the per-CPU cached xfd_state was not reset, so later xfd_update_state() may skip a needed MSR write. XRSTOR can then raise #NM in kernel space and crash the kernel.
Likely exposure
Exposure is most relevant to Linux systems running affected kernel versions or commits on x86 hardware. The source bundle lists Linux 5.16 and affected/fixed stable-line markers including 6.1.84, 6.6.24, 6.7.12, 6.8.3, and 6.9.
Exploitation context
The CVSS vector is local, low-complexity, low-privilege, and no user interaction. The bundle does not show CISA KEV listing or any cited evidence of active exploitation. Public impact evidence in the description centers on kernel crash.
Researcher notes
The root cause is stale per-CPU xfd_state after CPU hotplug resets MSR_IA32_XFD. The fix centralizes updates through xfd_set_state() so cached state and the MSR are written together. Evidence is limited to CVE data and upstream stable commit references.
Mitigation direction
- Update to a vendor Linux kernel containing the referenced stable fixes.
- Prioritize x86 Linux systems where untrusted users or workloads have local access.
- Check distribution advisories for backported fixes before relying on version strings alone.
- Limit unnecessary local account or workload access on affected hosts until patched.
- Avoid ad hoc kernel changes; follow vendor-supported kernel update paths.
Validation and detection
- Inventory Linux kernel versions and vendor build identifiers across x86 fleets.
- Map installed kernels to vendor advisories and the referenced upstream stable commits.
- Confirm patched systems include the xfd_state and MSR_IA32_XFD synchronization fix.
- Review crash telemetry for kernel #NM or XRSTOR-related faults after CPU hotplug.
- Validate remediation in staging before production kernel rollout.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-416: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2024-35801 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/21c7c00dae55cb0e3810d5f9506b58f68475d41dCVE reference, Linux
- https://git.kernel.org/stable/c/1acbca933313aa866e39996904c9aca4d435c4cdCVE reference, Linux
- https://git.kernel.org/stable/c/92b0f04e937665bde5768f3fcc622dcce44413d8CVE reference, Linux
- https://git.kernel.org/stable/c/b61e3b7055ac6edee4be071c52f48c26472d2624CVE reference, Linux
- https://git.kernel.org/stable/c/10e4b5166df9ff7a2d5316138ca668b42d004422CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use After Free
Use After Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.