LiveActive security incident?Get immediate response
CVE Record

CVE-2024-46762: xen: privcmd: Fix possible access to a freed kirqfd instance

In the Linux kernel, the following vulnerability has been resolved: xen: privcmd: Fix possible access to a freed kirqfd instance Nothing prevents simultaneous ioctl calls to privcmd_irqfd_assign() and privcmd_irqfd_deassign(). If that happens, it is possible that a kirqfd created and added to the irqfds_list by privcmd_irqfd_assign() may get removed by another thread executing privcmd_irqfd_deassign(), while the former is still using it after dropping the locks. This can lead to a situation where an already freed kirqfd instance may be accessed and cause kernel oops. Use SRCU locking to prevent the same, as is done for the KVM implementation for irqfds.

HighCVSS 7.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A local user with limited privileges may trigger a race in Linux’s Xen privcmd interface, causing access to freed kernel memory and a kernel crash. The supplied CVSS score is 7.8 (high), with confidentiality, integrity, and availability impacts modeled as high, although the description specifically confirms only a possible kernel oops.

Executive priority

Prioritize remediation on exposed Xen infrastructure, especially multi-user or shared systems. The vulnerability is local rather than remotely reachable, reducing urgency for systems without relevant Xen functionality. Because a kernel crash can disrupt hosted workloads, patch during the next accelerated maintenance window after confirming vendor applicability.

Technical view

Concurrent privcmd_irqfd_assign() and privcmd_irqfd_deassign() ioctl calls can remove and free a kirqfd while the assigning thread still uses it after releasing locks. This use-after-free condition can cause a kernel oops. The referenced Linux stable fixes introduce SRCU locking, following the KVM irqfd approach.

Likely exposure

Exposure requires an affected Linux kernel, use or reachability of the Xen privcmd irqfd path, and a local low-privileged actor able to issue the relevant ioctl calls. The bundle lists 6.6, 6.6.51, 6.10.10, and 6.11 as affected, but its version data is ambiguous; confirm mappings with the operating-system vendor.

Exploitation context

The CVSS vector indicates local access, low attack complexity, low privileges, and no user interaction. CISA KEV status is false, and the supplied sources provide no evidence of active exploitation or a public exploit. Treat practical exploitability beyond inducing a kernel oops as unconfirmed.

Researcher notes

The core issue is a concurrency-driven kirqfd use-after-free after locks are dropped. The sources identify SRCU as the correction and provide three stable-tree commits. They do not establish reliable exploitation beyond kernel oops, affected distribution packages, attack prerequisites beyond the CVSS vector, or active exploitation. The repeated commit identifier and literal version “0” indicate source-data quality limitations.

Mitigation direction

  • Apply a vendor-supported kernel update containing the applicable referenced stable fix.
  • Prioritize Xen hosts where untrusted local users can reach the privcmd irqfd interface.
  • If immediate patching is unavailable, consult the Linux distribution or appliance vendor for supported mitigations.
  • Avoid assuming upstream version numbers map directly to vendor backported kernels.

Validation and detection

  • Inventory Linux kernel versions on Xen systems and identify vendor backport status.
  • Confirm whether Xen privcmd and its irqfd functionality are present and reachable.
  • Verify the installed kernel contains the applicable referenced SRCU locking fix.
  • Review kernel logs for unexplained oops events involving Xen privcmd or kirqfd handling.
  • Use vendor advisories to resolve the bundle’s ambiguous affected-version data.
Prepared
Confidence
high
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2024-46762 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
1ADP providers
4Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.8CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.8High
CVSS 3.1 vector shape for CVE-2024-46762Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxf8941e6c4c712948663ec5d7bbb546f1a0f4e3f6, f8941e6c4c712948663ec5d7bbb546f1a0f4e3f6, f8941e6c4c712948663ec5d7bbb546f1a0f4e3f6unaffected
LinuxLinux6.6, 0, 6.6.51, 6.10.10, 6.11affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.