Security readout for executives and security teams
Plain-English summary
CVE-2024-46750 is a Linux kernel PCI locking flaw. During some PCI bus reset paths, the kernel failed to lock the bridge device, which could allow unsafe concurrent reset behavior. The public record frames this as a kernel correctness and stability fix, not a confirmed remote compromise issue.
Executive priority
Treat this as a routine-to-moderate kernel maintenance item unless your environment depends on affected Linux-based appliances or PCI-heavy infrastructure. There is no sourced evidence of exploitation, but kernel stability defects still warrant timely patching through normal maintenance windows.
Technical view
The issue is in Linux PCI reset locking. pci_bus_lock() locked devices below a bus but missed bus->self, the bridge itself. Lockdep identified unlocked secondary bus resets through pci_reset_bus() and vmd_probe(). Stable fixes add bridge locking while avoiding recursive locking deadlock.
Likely exposure
Exposure is limited to systems running affected Linux kernel builds with the vulnerable PCI code. The bundle does not prove that every Linux deployment is practically reachable; validate kernel package versions, vendor backports, and whether the fix is included in your distribution.
Exploitation context
No source in the bundle reports active exploitation, and KEV is false. The evidence describes an internal kernel locking defect found by lockdep, with call traces around PCI/VMD reset handling. Practical exploitability, attacker prerequisites, and impact are not specified in the provided sources.
Researcher notes
The key technical point is missing locking of bus->self in pci_bus_lock(). The source bundle provides fix commits and advisory references but lacks CVSS, CWE, exploit prerequisites, or demonstrated impact. Version status appears incomplete, so rely on vendor backport evidence rather than raw upstream version strings alone.
Mitigation direction
- Update to a vendor kernel release containing the stable PCI locking fix.
- Apply Debian LTS or distribution security updates where applicable.
- Check Siemens advisories for affected industrial products using bundled Linux kernels.
- Avoid direct wrangler-style assumptions; follow your OS or device vendor guidance.
- Track kernel stable commits listed in the CVE record for backport confirmation.
Validation and detection
- Inventory Linux kernel versions across servers, appliances, and embedded devices.
- Confirm whether vendor packages include the referenced stable commits or equivalent backports.
- Review distribution security advisories for CVE-2024-46750 coverage.
- Prioritize systems using PCI reset paths, VMD, or vendor appliances named in advisories.
- Document exceptions where vendor guidance is unavailable or deferred.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-46750 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/0790b89c7e911003b8c50ae50e3ac7645de1fae9CVE reference, Linux
- https://git.kernel.org/stable/c/df77a678c33871a6e4ac5b54a71662f1d702335bCVE reference, Linux
- https://git.kernel.org/stable/c/e2355d513b89a2cb511b4ded0deb426cdb01acd0CVE reference, Linux
- https://git.kernel.org/stable/c/04e85a3285b0e5c5af6fd2c0fd6e95ffecc01945CVE reference, Linux
- https://git.kernel.org/stable/c/7253b4fed46471cc247c6cacefac890a8472c083CVE reference, Linux
- https://git.kernel.org/stable/c/78c6e39fef5c428960aff742149bba302dd46f5aCVE reference, Linux
- https://git.kernel.org/stable/c/81c68e218ab883dfa368460a59b674084c0240daCVE reference, Linux
- https://git.kernel.org/stable/c/a4e772898f8bf2e7e1cf661a12c60a5612c4afabCVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2024/10/msg00003.htmlCVE reference, CVE
- https://cert-portal.siemens.com/productcert/html/ssa-398330.htmlCVE reference, siemens-SADP
- https://cert-portal.siemens.com/productcert/html/ssa-265688.htmlCVE reference, siemens-SADP
- https://cert-portal.siemens.com/productcert/html/ssa-355557.htmlCVE reference, siemens-SADP
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.