Security readout for executives and security teams
Plain-English summary
A flaw in the Linux kernel’s Radeon graphics driver can use an object after its pointer has been cleared. A local, low-privileged user may trigger serious security impact without user interaction. Actual exploitability beyond a kernel fault is not demonstrated by the supplied sources.
Executive priority
Treat as a high-priority kernel update for affected Radeon-enabled or multi-user Linux systems. Prioritize environments allowing untrusted local execution. Emergency internet-edge action is not supported by the evidence because exploitation is local and active exploitation is not reported.
Technical view
The Radeon virtual-memory path calls radeon_vm_clear_freed, which may set bo_va->bo to NULL. Subsequent code could dereference that pointer without checking it. Referenced stable-kernel commits add the required non-NULL check. CVSS 3.1 is 7.8: local access, low complexity, low privileges, no interaction, and potentially high confidentiality, integrity, and availability impact.
Likely exposure
Exposure is limited to systems running an affected Linux kernel with the Radeon DRM code relevant to their configuration or workload. The bundle lists affected releases including 3.19, 5.10.234, 5.15.164, 6.1.101, 6.6.42, 6.9.11, and 6.10, but does not provide complete distribution package mapping.
Exploitation context
The CVSS vector describes a local, low-privileged attack requiring no user interaction. CVE-2024-41060 is not identified as KEV, and the supplied sources do not report active exploitation or provide evidence of a public exploit. Internet exposure alone is therefore not the primary risk indicator.
Researcher notes
The core defect is an unchecked NULL dereference after radeon_vm_clear_freed may clear bo_va->bo. The supplied CVSS claims potential high impact across confidentiality, integrity, and availability, but the sources do not establish a practical privilege-escalation path. Validate branch-specific fixes through the referenced stable commits and distribution backports.
Mitigation direction
- Update to a vendor-supported kernel containing the referenced Radeon fixes.
- Check Linux distribution advisories for the corrected package version for each deployed release.
- Prioritize multi-user systems where untrusted users can execute local code.
- Apply normal kernel-update reboot requirements and confirm the new kernel is active.
Validation and detection
- Inventory active kernel versions and identify systems using affected releases.
- Determine whether Radeon DRM functionality is present and relevant on each system.
- Compare installed distribution packages against vendor security advisories.
- After updating and rebooting, verify the running kernel matches the corrected package.
- Review kernel logs for Radeon-related faults, while recognizing absence does not prove safety.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-41060 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/e8d3c53c6f1cccea9c03113f06dd39521c228831CVE reference, Linux
- https://git.kernel.org/stable/c/a2b201f83971df03c8e81a480b2f2846ae8ce1a3CVE reference, Linux
- https://git.kernel.org/stable/c/a9100f17428cb733c4f6fbb132d98bed76318342CVE reference, Linux
- https://git.kernel.org/stable/c/f13c96e0e325a057c03f8a47734adb360e112efeCVE reference, Linux
- https://git.kernel.org/stable/c/8a500b3a5f0a58c6f99039091fbd715f64f2f8afCVE reference, Linux
- https://git.kernel.org/stable/c/6fb15dcbcf4f212930350eaee174bb60ed40a536CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/03/msg00002.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.