Security readout for executives and security teams
Plain-English summary
A flaw in the Linux Lantiq Ethernet driver can free the same network buffer more than once while detaching the device. This may corrupt kernel memory, potentially causing crashes or broader compromise. Exposure is limited to systems using the affected driver and vulnerable kernel code.
Executive priority
Treat as a high-priority, targeted kernel update for exposed Lantiq-based systems. Rapidly determine whether the driver is present and used; avoid classifying the entire Linux estate as vulnerable without validation.
Technical view
The lantiq_etop detach path fails to increment the released-descriptor counter, causing the same socket buffer (skb) to be released repeatedly. The supplied CVSS 3.1 score is 8.8 with an adjacent-network vector and high confidentiality, integrity, and availability impacts, although the bundle does not document a practical exploitation method.
Likely exposure
Prioritize Linux-based networking or embedded systems that use the lantiq_etop driver. Merely running Linux does not establish exposure. The supplied version data identifies affected kernel lines but is ambiguous, so confirm applicability against the exact vendor kernel build and stable fix commits.
Exploitation context
CISA KEV status is false, and the supplied sources provide no evidence of active exploitation or a public exploit. The defect occurs during driver detach; the bundle does not establish whether an adjacent attacker can reliably trigger or exploit that condition in real deployments.
Researcher notes
The root cause is a descriptor-accounting error producing a double free of an skb in the detach path. Stable-branch fixes are referenced, but the bundle does not provide reliable exploitability details, a CWE assignment, or evidence supporting the CVSS confidentiality and integrity consequences in practice.
Mitigation direction
- Update to a vendor-supported kernel containing the applicable Linux stable fix commit.
- Review the Debian LTS advisory if affected systems use Debian packages.
- Follow device or distribution vendor guidance for backported kernels.
- Restrict untrusted adjacent-network access while remediation is pending.
Validation and detection
- Inventory systems using the lantiq_etop Ethernet driver.
- Record each system's exact kernel and distribution package version.
- Confirm vendor changelogs include the applicable stable fix.
- Retest device detach, shutdown, and interface lifecycle operations after updating.
- Monitor affected systems for kernel crashes or memory-corruption indicators.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-41046 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H2.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
8.8HighVector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/1a2db00a554cfda57c397cce79b2804bf9633fecCVE reference, Linux
- https://git.kernel.org/stable/c/907443174e76b854d28024bd079f0e53b94dc9a1CVE reference, Linux
- https://git.kernel.org/stable/c/22b16618a80858b3a9d607708444426948cc4ae1CVE reference, Linux
- https://git.kernel.org/stable/c/69ad5fa0ce7c548262e0770fc2b726fe7ab4f156CVE reference, Linux
- https://git.kernel.org/stable/c/c2b66e2b3939af63699e4a4bd25a8ac4a9b1d1b3CVE reference, Linux
- https://git.kernel.org/stable/c/9d23909ae041761cb2aa0c3cb1748598d8b6bc54CVE reference, Linux
- https://git.kernel.org/stable/c/84aaaa796a19195fc59290154fef9aeb1fba964fCVE reference, Linux
- https://git.kernel.org/stable/c/e1533b6319ab9c3a97dad314dd88b3783bc41b69CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.