Security readout for executives and security teams
Plain-English summary
A Linux graphics-driver cleanup error can leave a connector holding an invalid I2C pointer after device removal. On affected systems using the mgag200 driver, a local low-privileged user may potentially cause serious confidentiality, integrity, or availability impact. The supplied sources do not establish practical exploitation or attacks in the wild.
Executive priority
Treat this as an expedited kernel-maintenance issue for systems using mgag200, especially shared hosts with untrusted local users. It is high severity but not evidenced as remotely exploitable or actively exploited. First establish driver usage and vendor patch status; avoid emergency-wide action on systems shown not to use the affected path.
Technical view
CVE-2024-44967 is a lifetime-management flaw in Linux DRM's mgag200 driver. Linux device-managed cleanup could release the I2C adapter while struct drm_connector.ddc still referenced it, creating a stale pointer. The kernel fix binds adapter cleanup to the DRM device lifecycle, ensuring connector cleanup occurs first. The CVSS 3.1 score is 7.8 with local, low-privilege access required.
Likely exposure
Exposure is limited to Linux systems running an affected kernel and using the mgag200 graphics path. The supplied version data identifies affected Linux versions including 6.0 through specified later releases, but does not clearly express every branch boundary. Systems without the driver or relevant hardware are less likely exposed. Confirm status through distribution advisories and backport records.
Exploitation context
The CVSS vector describes local access, low privileges, low complexity, and no user interaction. CISA KEV status is false in the supplied bundle, and no cited source reports active exploitation. The sources do not demonstrate a working exploit, reachable attack path, or observed compromise.
Researcher notes
The defect is a stale-pointer condition caused by mismatched Linux-device and DRM-device cleanup ordering. The stated fix replaces Linux device-managed I2C release with DRM-managed release so connector teardown precedes adapter cleanup. No CWE is supplied. Exact affected branch boundaries and exploitability details remain incomplete, so validate against the relevant stable commit and downstream kernel advisory.
Mitigation direction
- Apply a vendor-supported kernel update containing the relevant stable fix or distribution backport.
- Prioritize shared or multi-user systems where untrusted users have local access.
- If updates are delayed, assess whether mgag200 is required and follow vendor guidance for temporary risk reduction.
- Reboot into the updated kernel after completing normal change-control and availability checks.
Validation and detection
- Inventory kernel versions and determine which systems load or depend on the mgag200 driver.
- Compare installed kernel changelogs or source commits with the cited stable fixes.
- Check distribution security advisories for branch-specific fixed package versions and backport status.
- After updating, verify the running kernel changed and confirm graphics functionality remains stable.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-44967 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/55a6916db77102765b22855d3a0add4751988b7cCVE reference, Linux
- https://git.kernel.org/stable/c/81d34df843620e902dd04aa9205c875833d61c17CVE reference, Linux
- https://git.kernel.org/stable/c/9d96b91e03cba9dfcb4ac370c93af4dbc47d5191CVE reference, Linux
- https://git.kernel.org/stable/c/eb1ae34e48a09b7a1179c579aed042b032e408f4CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.