LiveActive security incident?Get immediate response
CVE Record

CVE-2024-39489: ipv6: sr: fix memleak in seg6_hmac_init_algo

In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: fix memleak in seg6_hmac_init_algo seg6_hmac_init_algo returns without cleaning up the previous allocations if one fails, so it's going to leak all that memory and the crypto tfms. Update seg6_hmac_exit to only free the memory when allocated, so we can reuse the code directly.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2024-39489 is a Linux kernel memory leak in IPv6 Segment Routing HMAC initialization. If an allocation fails, earlier allocations are not cleaned up, leaking memory and crypto transform objects. The public bundle does not provide CVSS, severity, or evidence of active exploitation.

Executive priority

Treat as a tracking and patch-management item, not an emergency, unless critical systems run affected kernels and cannot be updated. The absence of severity scoring and exploit evidence limits urgency, but kernel memory leaks can affect availability.

Technical view

The flaw is in seg6_hmac_init_algo. On partial initialization failure, the function returned without releasing prior allocations. The fix updates cleanup handling so seg6_hmac_exit can free only allocated objects and be reused safely during failure paths.

Likely exposure

Exposure is most likely on Linux systems or embedded products running affected kernel builds with IPv6 Segment Routing HMAC code present. Siemens advisories are referenced, indicating downstream product relevance, but the supplied bundle does not list exact Siemens model exposure.

Exploitation context

CISA KEV status is false, and the source bundle gives no public exploit evidence. The realistic concern from the available facts is resource leakage and possible availability impact under conditions that repeatedly hit the failing initialization path.

Researcher notes

The record describes a failure-path memory leak, not memory corruption or privilege escalation. Evidence is limited to the CVE text, Linux stable commits, and downstream advisories. Do not assume remote exploitability without subsystem configuration and trigger-path analysis.

Mitigation direction

  • Map running kernels to the CVE record’s affected versions and fixed commits.
  • Apply Linux stable kernel updates containing the referenced fixes.
  • For Siemens products, follow the linked Siemens ProductCERT advisories.
  • If patch timing is unclear, request vendor guidance for affected firmware or appliances.

Validation and detection

  • Confirm the deployed kernel version and vendor build lineage.
  • Check whether IPv6 Segment Routing support is present or enabled.
  • Verify package, firmware, or kernel changelogs reference CVE-2024-39489 or the fix commits.
  • Review vendor advisories for product-specific affected and fixed versions.
Prepared
Confidence
medium
Sources
12

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2024-39489 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
3ADP providers
12Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc
CVECVE Program Container
siemens-SADPADP container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxbf355b8d2c30a289232042cacc1cfaea4923936c, bf355b8d2c30a289232042cacc1cfaea4923936c, bf355b8d2c30a289232042cacc1cfaea4923936c, bf355b8d2c30a289232042cacc1cfaea4923936c, bf355b8d2c30a289232042cacc1cfaea4923936c, bf355b8d2c30a289232042cacc1cfaea4923936c, bf355b8d2c30a289232042cacc1cfaea4923936c, bf355b8d2c30a289232042cacc1cfaea4923936cunaffected
LinuxLinux4.10, 0, 4.19.316, 5.4.278, 5.10.219, 5.15.161, 6.1.93, 6.6.33, 6.9.4, 6.10affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.