Security readout for executives and security teams
Plain-English summary
A Linux MANA network-driver error path can free the same memory twice. A local, low-privileged attacker might cause a crash or potentially compromise the affected system, although the supplied sources do not demonstrate a working exploit or active attacks.
Executive priority
Treat as a high-priority maintenance issue for multi-user or untrusted-workload Linux systems using MANA. Schedule prompt kernel updates after normal compatibility testing. Prioritize internet-facing cloud workloads only when local users, containers, or applications could gain low-privileged execution; the evidence does not indicate a remotely exploitable network flaw.
Technical view
If auxiliary_device_add() fails, auxiliary_device_uninit() invokes adev_release, which frees madev. The subsequent error cleanup could free madev again. The referenced kernel correction sets madev to NULL after uninitialization. CVSS 3.1 scores this 7.8 with local access, low privileges, and potentially high confidentiality, integrity, and availability impact.
Likely exposure
Exposure is most likely on affected Linux kernels where the MANA network driver is present and its auxiliary-device initialization reaches the failure path. The bundle identifies versions including 6.2, 6.6.37, 6.9.8, and 6.10, but its version-range representation is incomplete; confirm status through distribution guidance.
Exploitation context
The CVSS vector requires local access and low privileges, with no user interaction. The CVE is not in KEV, and the supplied sources report neither active exploitation nor a public proof of concept. Remote network exploitation is not supported by the evidence. Practical triggering depends on a driver-specific initialization failure.
Researcher notes
The core condition is a double free in error cleanup, not the normal initialization path. Assess reachability through MANA driver deployment and auxiliary_device_add() failure handling. The supplied version list does not clearly express introduction and fixed boundaries, so use distribution package metadata and referenced commits for authoritative backport verification.
Mitigation direction
- Update to a vendor-supported Linux kernel containing the referenced stable correction.
- Prioritize affected systems that load or configure the MANA network driver.
- Consult your Linux distribution's advisory for exact fixed package versions and supported backports.
- If updating is delayed, obtain vendor-supported mitigation guidance; the bundle names no temporary workaround.
Validation and detection
- Inventory running kernel versions and identify systems using the MANA network driver.
- Confirm kernel packages contain a backport matching one of the referenced stable corrections.
- Review kernel logs for MANA auxiliary-device initialization failures or related memory errors.
- After updating, verify the corrected kernel is running, including after reboot where required.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-42069 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/3243e64eb4d897c3eeb48b2a7221ab5a95e1282aCVE reference, Linux
- https://git.kernel.org/stable/c/ed45c0a0b662079d4c0e518014cc148c753979b4CVE reference, Linux
- https://git.kernel.org/stable/c/1864b8224195d0e43ddb92a8151f54f6562090ccCVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/03/msg00028.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.