Security readout for executives and security teams
Plain-English summary
A Linux network driver can access memory after freeing it while a txgbe device is being removed under MSI or legacy INTx interrupts. This may crash the host or corrupt kernel memory. The supplied CVSS rates potential confidentiality, integrity, and availability impacts as high, but the sources do not demonstrate practical privilege escalation or data theft.
Executive priority
Treat as a high-priority kernel maintenance issue for affected txgbe hosts, especially infrastructure where a crash would disrupt critical services. It is not supported as an internet-wide emergency: exploitation requires local access, affected driver conditions, and device lifecycle activity. Patch during the next expedited maintenance window after confirming vendor applicability.
Technical view
CVE-2024-42112 is a use-after-free condition in the Linux txgbe network driver. Shared interrupts can continue reading ISB memory during device removal before IRQs are released. The correction delays ISB resource cleanup until txgbe_remove() and repairs cleanup in the txgbe_open() error path. The supplied CVSS 3.1 score is 7.8 with local, low-privilege access required.
Likely exposure
Exposure is limited to systems running an affected Linux kernel with the txgbe driver and relevant network hardware, particularly where MSI or INTx interrupts and device removal occur. The bundle identifies 6.9, 6.9.9, and 6.10 as affected, but its version data includes an unexplained “0”; confirm exact distribution status with the kernel vendor.
Exploitation context
The supplied vector requires local access and low privileges, with no user interaction. No CISA KEV listing or cited evidence of active exploitation is provided. The sources establish a kernel memory-lifetime flaw, but do not establish a reliable exploitation method, observed attacks, or whether exploitation beyond denial of service is practical.
Researcher notes
The vulnerable lifetime ordering is specific: ISB storage was released while shared interrupt handlers could still reference it before IRQ teardown. The fixes relocate cleanup from close to remove and correct open-error cleanup. No CWE is supplied. Exact affected-release boundaries are not fully clear from the flattened version list, so commit-level or distribution-advisory verification is preferable.
Mitigation direction
- Upgrade to a vendor-supported kernel containing the referenced stable fix.
- Confirm the distribution's advisory maps its kernel build to the fix commits.
- Prioritize systems actively using the txgbe driver and affected network hardware.
- Where upgrades are delayed, consult vendor guidance for supported risk-reduction options.
Validation and detection
- Record the running kernel version and distribution build on potentially affected hosts.
- Check whether the txgbe driver is present and actively bound to network hardware.
- Verify the installed kernel includes either applicable referenced stable fix commit.
- Review kernel logs for crashes or memory faults associated with txgbe device removal.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-42112 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/efdc3f54299835ddef23bea651c753c4d467010bCVE reference, Linux
- https://git.kernel.org/stable/c/935124dd5883b5de68dc5a94f582480a10643dc9CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.