Security readout for executives and security teams
Plain-English summary
A Linux NVMe storage error-handling flaw can free the same request payload twice when a discard operation is retried and fails early. This memory corruption could crash a system and may have broader security consequences. Actual exposure depends on the running kernel, NVMe use, and reaching this specific failure path.
Executive priority
Treat as an urgent kernel patching issue for exposed NVMe systems, especially availability-critical infrastructure. Prioritize inventory and vendor-supported updates, but do not infer internet-wide remote compromise from the 9.8 score alone. No active exploitation evidence is supplied.
Technical view
During cleanup of a retried NVMe discard request, the kernel failed to clear RQF_SPECIAL_LOAD. If the retry failed before attaching a replacement special payload, later cleanup could free the previous payload again. The upstream correction clears that flag during request cleanup. The supplied CVSS is 9.8, although the description alone does not establish practical remote reachability.
Likely exposure
Potentially affected Linux systems are those running vulnerable kernel branches and exercising NVMe discard requests under retry and early-failure conditions. The supplied version list is ambiguous when flattened, so determine exposure using distribution advisories, kernel package changelogs, or inclusion of the referenced stable fix—not version numbers alone.
Exploitation context
The bundle does not report known active exploitation, and the CVE is not listed as KEV. It provides no public exploit evidence. Triggering requires the described NVMe discard retry and failure sequence; whether an untrusted remote party can cause that sequence is not established by the supplied sources.
Researcher notes
The affected mechanism is a double free in NVMe request cleanup involving RQF_SPECIAL_LOAD. Stable-tree commits and Debian advisories indicate backported remediation. The supplied AV:N vector appears difficult to reconcile with the described storage-path precondition; researchers should avoid asserting remote exploitability without additional evidence. Impact beyond memory corruption or denial of service is not demonstrated here.
Mitigation direction
- Install a vendor-supported kernel containing the referenced NVMe fix.
- Apply the relevant Debian security update where the cited Debian advisories govern the system.
- Prioritize storage hosts where NVMe discard operations and reliability failures are plausible.
- Check current Linux distribution guidance before adopting temporary mitigations.
Validation and detection
- Record each system's running kernel release and package build.
- Verify the installed kernel includes the stable fix or vendor backport.
- Identify systems using NVMe storage and discard functionality.
- Confirm patched kernels are running after maintenance or reboot.
- Review vendor advisories because the supplied version list lacks clear range boundaries.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-41073 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9LinuxVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/882574942a9be8b9d70d13462ddacc80c4b385baCVE reference, Linux
- https://git.kernel.org/stable/c/c5942a14f795de957ae9d66027aac8ff4fe70057CVE reference, Linux
- https://git.kernel.org/stable/c/f3ab45aacd25d957547fb6d115c1574c20964b3bCVE reference, Linux
- https://git.kernel.org/stable/c/ae84383c96d6662c24697ab6b44aae855ab670aaCVE reference, Linux
- https://git.kernel.org/stable/c/1b9fd1265fac85916f90b4648de02adccdb7220bCVE reference, Linux
- https://git.kernel.org/stable/c/e5d574ab37f5f2e7937405613d9b1a724811e5adCVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/05/msg00030.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.