Security readout for executives and security teams
Plain-English summary
CVE-2024-42314 is a Linux kernel memory-safety flaw in Btrfs. Under specific compressed I/O activity, the kernel can access an object after releasing it. A local, low-privileged user may be able to trigger serious confidentiality, integrity, or availability consequences. Exposure depends on the installed kernel and use of Btrfs.
Executive priority
Treat as a high-priority kernel maintenance issue on multi-user or untrusted-workload systems using Btrfs. Patch through supported distribution channels promptly, with faster handling where local users or workloads are not fully trusted. Lower urgency may be reasonable when Btrfs is absent, after verification.
Technical view
The Btrfs add_ra_bio_pages() path calculated add_size from an extent map after releasing its reference, creating a use-after-free. The kernel fix moves that calculation before the reference is dropped. CVSS 3.1 rates the issue 7.8 with local access, low complexity, low privileges, no user interaction, and high potential impact.
Likely exposure
Prioritize Linux systems using Btrfs and potentially exercising compressed read-ahead paths. The supplied version data identifies Linux 5.16 and several later branch versions but is ambiguous about exact fixed boundaries. Confirm distributor package status or whether the running kernel incorporates a referenced stable fix.
Exploitation context
The CVSS vector requires local access and low privileges. The supplied sources provide no evidence of active exploitation, public weaponization, or remote reachability, and the CVE is not listed as KEV in the bundle. Practical exploitability is therefore unconfirmed.
Researcher notes
The source bundle contains duplicated commit identifiers and a flattened affected-version list that does not clearly express branch ranges. Avoid inferring exact vulnerable boundaries from those fields alone. Compare downstream package backports against the four stable commits. No CWE was supplied, although the description explicitly identifies a use-after-free.
Mitigation direction
- Update to a vendor-supported kernel package containing the applicable referenced stable fix.
- Reboot affected systems so the corrected kernel is actually running.
- Follow Linux distributor guidance for package-specific fixed versions.
- If patching is delayed, consult vendor guidance; the supplied sources name no temporary mitigation.
Validation and detection
- Inventory running kernel releases and systems with Btrfs filesystems.
- Map distributor kernel packages to the referenced upstream stable fixes.
- After updating, verify the running kernel changed following reboot.
- Review kernel logs for Btrfs faults, noting their absence does not prove safety.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-42314 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/c1cc3326e27b0bd7a2806b40bc48e49afaf951e7CVE reference, Linux
- https://git.kernel.org/stable/c/c205565e0f2f439f278a4a94ee97b67ef7b56ae8CVE reference, Linux
- https://git.kernel.org/stable/c/b7859ff398b6b656e1689daa860eb34837b4bb89CVE reference, Linux
- https://git.kernel.org/stable/c/8e7860543a94784d744c7ce34b78a2e11beefa5cCVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.