Security readout for executives and security teams
Plain-English summary
A race in the Linux kernel’s Greybus interface cleanup can leave background work using memory after it has been freed. A local, low-privileged attacker may potentially cause a crash or compromise confidentiality and integrity, but the supplied sources do not demonstrate successful exploitation.
Executive priority
Schedule prompt remediation for systems using Greybus, especially those allowing untrusted local users. Treat general-purpose systems without active Greybus use as lower practical exposure after validation. This is high severity, but the supplied evidence does not support emergency treatment based on active exploitation.
Technical view
The Greybus mode-switch worker retains access to the interface object. During a timing race, gb_interface_release can free that object before the queued worker runs, producing a CWE-416 use-after-free. The kernel fix cancels pending mode-switch work before freeing the object. CVSS 3.1 is 7.8 with local access and low privileges required.
Likely exposure
Exposure is most likely where an affected Linux kernel includes and actively uses Greybus interface mode switching. The supplied version data identifies affected releases from 4.9 through 6.10, with several fixed stable releases listed. Confirm status against the exact distribution kernel because backports can change vulnerability status.
Exploitation context
The CVSS vector requires local access and low privileges, with no user interaction. Exploitation depends on winning a cleanup-versus-worker timing race. The bundle marks this CVE as absent from KEV and provides no evidence of active exploitation or a public exploit.
Researcher notes
The failure window is between freeing the Greybus interface in gb_interface_release and later execution of gb_interface_mode_switch_work, which accesses the freed object’s mutex. Stable fixes cancel outstanding work before kfree. The supplied affected-version list contains ambiguous entries, including “0” and repeated commit identifiers; use branch-specific commits or distribution advisories for authoritative mapping.
Mitigation direction
- Install a vendor-supported kernel containing the applicable stable fix.
- Prioritize systems that include and actively use Greybus interfaces.
- Consult the Linux distribution’s advisory for exact fixed package versions.
- Restrict untrusted local access until affected systems are updated.
Validation and detection
- Record each system’s exact kernel and distribution package version.
- Check whether Greybus support is built, loaded, or operationally used.
- Compare kernel provenance against the cited stable fixes or vendor backports.
- Confirm the updated kernel is running after installation and reboot.
- Monitor kernel logs for crashes or memory-safety reports involving Greybus.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-416: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2024-39495 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/74cd0a421896b2e07eafe7da4275302bfecef201CVE reference, Linux
- https://git.kernel.org/stable/c/2b6bb0b4abfd79b8698ee161bb73c0936a2aaf83CVE reference, Linux
- https://git.kernel.org/stable/c/fb071f5c75d4b1c177824de74ee75f9dd34123b9CVE reference, Linux
- https://git.kernel.org/stable/c/9a733d69a4a59c2d08620e6589d823c24be773dcCVE reference, Linux
- https://git.kernel.org/stable/c/0b8fba38bdfb848fac52e71270b2aa3538c996eaCVE reference, Linux
- https://git.kernel.org/stable/c/03ea2b129344152157418929f06726989efc0445CVE reference, Linux
- https://git.kernel.org/stable/c/5c9c5d7f26acc2c669c1dcf57d1bb43ee99220ceCVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use After Free
Use After Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.