LiveActive security incident?Get immediate response
CVE Record

CVE-2024-43871: devres: Fix memory leakage caused by driver API devm_free_percpu()

In the Linux kernel, the following vulnerability has been resolved: devres: Fix memory leakage caused by driver API devm_free_percpu() It will cause memory leakage when use driver API devm_free_percpu() to free memory allocated by devm_alloc_percpu(), fixed by using devres_release() instead of devres_destroy() within devm_free_percpu().

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2024-43871 is a Linux kernel memory leak in a driver resource cleanup API. Systems may slowly lose kernel memory when affected driver code frees per-CPU allocations through this path. The public record does not provide CVSS scoring, confirmed exploitation, or a broad impact statement.

Executive priority

Treat as a routine-to-important kernel maintenance item, not an emergency based on the supplied evidence. Prioritize systems where downtime from resource exhaustion would be costly, and rely on vendor kernel updates rather than custom remediation.

Technical view

The bug is in devm_free_percpu(), which could leak memory allocated by devm_alloc_percpu(). The kernel fix changes cleanup behavior to use devres_release() instead of devres_destroy(). Exposure depends on running affected Linux kernel versions and driver paths that use this API pairing.

Likely exposure

Likely exposure is Linux systems running affected kernel builds, including downstream distributions or embedded products that have not incorporated the stable fixes. Practical exposure depends on loaded drivers and whether they exercise devm_alloc_percpu()/devm_free_percpu() cleanup paths.

Exploitation context

The provided sources do not show KEV listing or active exploitation. They describe a resolved kernel memory leak, not a public weaponized exploit. Impact is most plausibly availability or reliability degradation, but triggering conditions are not fully described in the source bundle.

Researcher notes

The record lacks CVSS, CWE, and detailed trigger conditions. The key technical fact is the devres cleanup mismatch in devm_free_percpu(). Further analysis should inspect downstream kernel backports and drivers using devm_alloc_percpu()/devm_free_percpu(), without assuming exploitability beyond the leak described.

Mitigation direction

  • Update affected Linux kernels to a vendor release containing the stable fix.
  • Check Debian, appliance, and OEM advisories for packaged kernel availability.
  • Prioritize reliability-critical systems where kernel memory pressure has business impact.
  • Monitor vendor guidance for any later severity, exploitability, or workaround details.

Validation and detection

  • Inventory Linux kernel versions across servers, appliances, and embedded systems.
  • Confirm whether vendor kernels include one of the referenced stable fixes.
  • Check downstream advisories for Debian LTS or relevant OEM product status.
  • Review kernel logs and monitoring for unexplained memory pressure on affected hosts.
Prepared
Confidence
medium
Sources
10

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2024-43871 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
3ADP providers
15Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc
CVECVE Program Container
siemens-SADPADP container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxff86aae3b4112b85d2231c23bccbc49589df1c06, ff86aae3b4112b85d2231c23bccbc49589df1c06, ff86aae3b4112b85d2231c23bccbc49589df1c06, ff86aae3b4112b85d2231c23bccbc49589df1c06, ff86aae3b4112b85d2231c23bccbc49589df1c06, ff86aae3b4112b85d2231c23bccbc49589df1c06, ff86aae3b4112b85d2231c23bccbc49589df1c06, ff86aae3b4112b85d2231c23bccbc49589df1c06unaffected
LinuxLinux4.10, 0, 4.19.320, 5.4.282, 5.10.224, 5.15.165, 6.1.103, 6.6.44, 6.10.3, 6.11affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.