Security readout for executives and security teams
Plain-English summary
A flaw in Linux’s VC4 graphics driver can mishandle an internal object reference during non-blocking display updates, causing a use-after-free condition. A locally authenticated user or process with graphics-device access may be able to crash the system or potentially affect confidentiality and integrity. Exposure is concentrated on systems actively using VC4 graphics, including relevant Raspberry Pi deployments.
Executive priority
Treat this as a high-priority patch for Raspberry Pi or other VC4-based appliances permitting local application or user access, especially kiosks and media systems where availability matters. It is less urgent for systems that do not use VC4. The sources do not establish active exploitation, so prioritize according to confirmed driver exposure rather than applying emergency internet-facing incident assumptions.
Technical view
During non-blocking DRM atomic commits, VC4 compared framebuffer pointers through plane->state directly. State changes could make prepare_fb and cleanup_fb adjust different reference counts, producing underflow and use-after-free in vc4_cleanup_fb. The kernel fix removes the unnecessary comparison, restoring balanced reference handling. The supplied CVSS 3.1 score is 7.8 with local, low-privilege, no-interaction exploitation characteristics.
Likely exposure
Prioritize Linux devices where the VC4 DRM driver is active and local users or applications can submit DRM ioctls. The supplied trace demonstrates the fault on a Raspberry Pi 3 running Kodi and Linux 6.1.66. Systems without VC4 hardware or an active VC4 driver are unlikely to be directly exposed. Vendor backports make version-string-only assessment unreliable.
Exploitation context
The CVSS vector describes local access with low privileges and no user interaction. The supplied sources demonstrate a kernel warning, reference-count underflow, and use-after-free, but provide no evidence of active exploitation. The CVE is not listed as CISA KEV in the bundle. Log evidence alone should not be treated as proof of malicious activity.
Researcher notes
The demonstrated path reaches vc4_cleanup_fb through DRM atomic ioctl handling during non-blocking commits. The bundle supplies four stable-kernel fix commits but does not preserve precise branch-range semantics in its flattened affected-version list. No CWE is assigned. Although CVSS claims high confidentiality, integrity, and availability impact, the supplied technical evidence directly demonstrates only reference-count corruption and a use-after-free warning.
Mitigation direction
- Install a distribution or device-vendor kernel containing the applicable referenced stable fix.
- Reboot affected devices so the corrected kernel and VC4 module are running.
- If patching is delayed, restrict untrusted local access to VC4 DRM device nodes where operationally feasible.
- Check distribution and device-vendor guidance for supported fixed packages and backports.
Validation and detection
- Inventory systems with VC4 hardware, driver configuration, or a loaded VC4 module.
- Verify the running vendor kernel includes CVE-2024-35932 or an applicable referenced fix commit.
- After rebooting, confirm the intended patched kernel is active.
- Review kernel logs for VC4-related refcount underflow, use-after-free warnings, or vc4_atomic_commit_tail traces.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-35932 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/48bfb4b03c5ff6e1fa1dc73fb915e150b0968c40CVE reference, Linux
- https://git.kernel.org/stable/c/d6b2fe2db1d0927b2d7df5c763eba55d0e1def3cCVE reference, Linux
- https://git.kernel.org/stable/c/5343f724c912c77541029123f47ecd3d2ea63bddCVE reference, Linux
- https://git.kernel.org/stable/c/5ee0d47dcf33efd8950b347dcf4d20bab12a3fa9CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.