LiveActive security incident?Get immediate response
CVE Record

CVE-2024-38554: ax25: Fix reference count leak issue of net_device

In the Linux kernel, the following vulnerability has been resolved: ax25: Fix reference count leak issue of net_device There is a reference count leak issue of the object "net_device" in ax25_dev_device_down(). When the ax25 device is shutting down, the ax25_dev_device_down() drops the reference count of net_device one or zero times depending on if we goto unlock_put or not, which will cause memory leak. In order to solve the above issue, decrease the reference count of net_device after dev->ax25_ptr is set to null.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2024-38554 is a Linux kernel bug in the AX.25 networking subsystem. When an AX.25 network device shuts down, the kernel may mishandle a net_device reference count and leak memory. The sources do not provide CVSS, real-world exploitation evidence, or a broad impact statement.

Executive priority

Treat as a targeted kernel maintenance issue, not an emergency based on current evidence. Prioritize patch validation where AX.25 is used or enabled, and include it in normal Linux kernel update governance.

Technical view

The issue is in ax25_dev_device_down(). During AX.25 device shutdown, net_device reference handling can drop the reference count inconsistently depending on control flow. The upstream fix moves the reference count decrement after dev->ax25_ptr is set to null, preventing the leak.

Likely exposure

Exposure appears limited to Linux systems with AX.25 networking present and relevant device shutdown paths exercised. The bundle lists Linux kernel versions and stable commits but provides no CPEs, distro package mapping, or CVSS score.

Exploitation context

The source bundle reports no CISA KEV listing and gives no evidence of active exploitation. It describes a memory leak, not code execution, privilege escalation, or data theft. Practical exploitability is not established by the provided sources.

Researcher notes

The CVE record is sparse: no CVSS, CWE, CPEs, exploit reports, or distro-specific ranges are provided. Analysis should center on the AX.25 subsystem, net_device lifetime handling, and whether local kernel builds include the linked stable fixes.

Mitigation direction

  • Check Linux distributor advisories for kernels containing the referenced stable fixes.
  • Update affected Linux kernels through normal vendor-supported channels.
  • Prioritize systems that enable or use AX.25 networking.
  • Track kernel.org stable commits referenced in the CVE record.
  • Document any compensating controls only if vendor guidance supports them.

Validation and detection

  • Inventory Linux kernel versions across affected assets.
  • Determine whether AX.25 support is enabled, loaded, or operationally required.
  • Compare deployed kernels with vendor advisories and referenced stable commits.
  • Review monitoring for unexplained kernel memory growth on relevant hosts.
  • Confirm remediated systems run vendor kernels containing the fix.
Prepared
Confidence
medium
Sources
7

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2024-38554 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
2ADP providers
6Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container
CISA-ADPCISA ADP Vulnrichment
other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxd01ffb9eee4af165d83b08dd73ebdf9fe94a519b, d01ffb9eee4af165d83b08dd73ebdf9fe94a519b, d01ffb9eee4af165d83b08dd73ebdf9fe94a519b, d01ffb9eee4af165d83b08dd73ebdf9fe94a519b, d01ffb9eee4af165d83b08dd73ebdf9fe94a519b, ef0a2a0565727a48f2e36a2c461f8b1e3a61922d, e2b558fe507a1ed4c43db2b0057fc6e41f20a14c, 418993bbaafb0cd48f904ba68eeda052d624c821, 5ea00fc60676c0eebfa8560ec461209d638bca9d, 9af0fd5c4453a44c692be0cbb3724859b75d739bunaffected
LinuxLinux5.17, 0, 6.1.93, 6.6.33, 6.8.12, 6.9.3, 6.10affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.