Security readout for executives and security teams
Plain-English summary
This is a Linux kernel ext4 filesystem bug. Under an out-of-memory error path, ext4 can leak an internal cache reference and later trigger a kernel warning during filesystem shutdown. It requires local access and low privileges. No provided source shows active exploitation.
Executive priority
Treat as a moderate Linux maintenance priority. It is not KEV-listed and needs local access, but kernel flaws on shared or multi-tenant systems deserve timely patching through normal update channels.
Technical view
In ext4_xattr_block_cache_find(), __entry_find() increments mb_cache_entry e_refcnt. If ext4_sb_bread() returns -ENOMEM, that reference was not released, causing an mb_cache reference leak and mb_cache_destroy() warning. The fix adds mb_cache_entry_put() on that error branch.
Likely exposure
Systems running affected Linux kernel versions with ext4 support are in scope, especially hosts where local low-privileged users or workloads can exercise ext4 extended-attribute paths. The source lists affected Linux version lines including 5.0 and stable series before listed fixes.
Exploitation context
KEV is false, and the provided sources do not report exploitation in the wild. The issue was reported by syzbot. CVSS marks local access, low complexity, low privileges, no user interaction, and high confidentiality impact, but the source bundle does not explain a data exposure mechanism.
Researcher notes
The public description is narrow: a reference-count leak on an -ENOMEM path in ext4 xattr cache lookup. The CVSS confidentiality rating is high, but the supplied evidence only details the leak and warning, not an exploitation chain.
Mitigation direction
- Update to a Linux kernel containing the referenced stable fix for your maintained branch.
- Use distribution kernel advisories and packages rather than manually selecting upstream commits.
- Prioritize multi-user systems, shared compute, containers, and hosts running untrusted local workloads.
- If immediate update is unavailable, reduce untrusted local shell or workload access where practical.
Validation and detection
- Inventory Linux kernel versions across servers, desktops, appliances, and container hosts.
- Confirm each kernel branch includes the applicable referenced stable commit or vendor backport.
- Identify systems using ext4 filesystems and extended attributes in local-user contexts.
- Review vendor security advisories for CVE-2024-39276 package status and fixed build numbers.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-39276 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/9ad75e78747b5a50dc5a52f0f8e92e920a653f16CVE reference, Linux
- https://git.kernel.org/stable/c/896a7e7d0d555ad8b2b46af0c2fa7de7467f9483CVE reference, Linux
- https://git.kernel.org/stable/c/76dc776153a47372719d664e0fc50d6355791abbCVE reference, Linux
- https://git.kernel.org/stable/c/681ff9a09accd8a4379f8bd30b7a1641ee19bb3eCVE reference, Linux
- https://git.kernel.org/stable/c/e941b712e758f615d311946bf98216e79145ccd9CVE reference, Linux
- https://git.kernel.org/stable/c/a95df6f04f2c37291adf26a74205cde0314d4577CVE reference, Linux
- https://git.kernel.org/stable/c/b37c0edef4e66fb21a2fbc211471195a383e5ab8CVE reference, Linux
- https://git.kernel.org/stable/c/0c0b4a49d3e7f49690a6827a41faeffad5df7e21CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.