Security readout for executives and security teams
Plain-English summary
A page-size calculation in the Linux Xe graphics driver could overflow, potentially allowing a low-privileged local user to compromise confidentiality, integrity, or availability. The issue requires local access; it is not described as remotely exploitable.
Executive priority
Treat as a high-priority local privilege risk, especially for shared workstations, build hosts, and other systems permitting untrusted local users. Prioritize confirmed Xe-driver exposure; broad emergency action is not supported by evidence of remote or active exploitation.
Technical view
The Xe DRM driver shifted tbo->page_alignment before conversion to a 64-bit value. On affected kernels, that operation could overflow and produce an incorrect min_page_size. The cited kernel changes explicitly cast the value to u64 before shifting.
Likely exposure
Exposure is most likely on systems running an affected Linux kernel with the drm/xe driver available to local users. The bundle lists 6.8, 6.9.8, and 6.10-related version data, but does not clearly express every range boundary.
Exploitation context
The CVSS vector describes local, low-complexity exploitation requiring low privileges and no user interaction, with potentially high confidentiality, integrity, and availability impact. KEV is false, and the supplied sources provide no evidence of active exploitation or public weaponization.
Researcher notes
The correction is narrowly defined: cast tbo->page_alignment to u64 before the bit shift used for min_page_size. The bundle provides two stable-kernel commits but no proof-of-concept, exploitation telemetry, affected hardware list, or complete distribution-specific package mapping.
Mitigation direction
- Apply a vendor-supported kernel update containing the cited upstream fix.
- Check distribution advisories for precise affected and fixed package versions.
- Prioritize multi-user systems where untrusted users can access the Xe driver.
- Restrict unnecessary local access while awaiting validated vendor remediation.
Validation and detection
- Inventory kernel versions on systems using or exposing the drm/xe driver.
- Confirm distribution packages include either cited stable-kernel correction.
- Review vendor advisories because the supplied version boundaries are incomplete.
- After updating, verify systems booted into the remediated kernel package.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-42066 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/79d54ddf0e292b810887994bb04709c5ac0e1531CVE reference, Linux
- https://git.kernel.org/stable/c/4f4fcafde343a54465f85a2909fc684918507a4bCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.