Security readout for executives and security teams
Plain-English summary
Linux's mISDN driver can continue using a network buffer after releasing it during transmission. This memory-safety flaw may let a local, low-privileged attacker compromise data or disrupt the host, reflected in CVSS 7.8. Exposure is concentrated on systems using the affected mISDN functionality, rather than every Linux system equally.
Executive priority
Prioritize prompt kernel maintenance on systems confirmed to use mISDN. Keep other potentially affected Linux assets in the normal high-severity patch cycle while validating applicability. The sources support serious local impact, but they do not support declaring an Internet-wide emergency or active exploitation campaign.
Technical view
CVE-2024-42280 is a use-after-free in Linux mISDN function hfcmulti_tx(). The transmit path freed *sp with dev_kfree_skb(*sp) and subsequently dereferenced it. The CVSS 3.1 vector is local, low-complexity, low-privilege, and no-user-interaction, with high confidentiality, integrity, and availability impacts. Stable-kernel commits provide branch-specific fixes.
Likely exposure
Most exposed are Linux hosts running affected kernels with mISDN HFC multiport functionality enabled and used. The CVSS vector requires local access and low privileges, so the record does not describe direct remote exploitation. The supplied version data does not form a clear universal range; confirm exact distributor package status instead of relying only on version strings.
Exploitation context
The bundle marks KEV false and contains no cited evidence of active exploitation or a public exploit. Attack complexity is rated low after obtaining a low-privileged local foothold and reaching the vulnerable driver path. Practical reach depends on system configuration and use of mISDN, which the supplied sources do not fully characterize.
Researcher notes
The defect is a post-free dereference of *sp after dev_kfree_skb(*sp) in hfcmulti_tx(). Multiple stable-kernel commits indicate branch-specific backports. The affected-version array is difficult to interpret as a universal range, and no CWE is supplied. Use commit ancestry and distributor advisories to establish fixed status.
Mitigation direction
- Identify hosts using the mISDN subsystem or affected HFC multiport functionality.
- Apply a vendor kernel update containing the applicable upstream stable fix.
- Follow distributor guidance for branch-specific package versions and reboot requirements.
- Expedite maintenance for systems confirmed to depend on the affected mISDN path.
Validation and detection
- Inventory running kernel builds on systems that may provide ISDN functionality.
- Check whether mISDN and the relevant HFC driver functionality are enabled or active.
- Compare installed packages with distributor advisories and applicable stable-kernel backports.
- After updating, confirm the fixed kernel is running following reboot.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-42280 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/70db2c84631f50e02e6b32b543700699dd395803CVE reference, Linux
- https://git.kernel.org/stable/c/d3e4d4a98c5629ccdcb762a0ff6c82ba9738a0c3CVE reference, Linux
- https://git.kernel.org/stable/c/9460ac3dd1ae033bc2b021a458fb535a0c36ddb2CVE reference, Linux
- https://git.kernel.org/stable/c/8f4030277dfb9dbe04fd78566b19931097c9d629CVE reference, Linux
- https://git.kernel.org/stable/c/4d8b642985ae24f4b3656438eb8489834a17bb80CVE reference, Linux
- https://git.kernel.org/stable/c/ddc79556641ee070d36be0de4a1f0a16a71f1fc7CVE reference, Linux
- https://git.kernel.org/stable/c/7e4a539bca7d8d20f2c5d93c18cce8ef77cd78e0CVE reference, Linux
- https://git.kernel.org/stable/c/61ab751451f5ebd0b98e02276a44e23a10110402CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2024/10/msg00003.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.