Security readout for executives and security teams
Plain-English summary
CVE-2024-46847 is a Linux kernel vmalloc race/initialization flaw. A partially initialized memory-management structure could be visible to another CPU, causing an out-of-bounds access. The public record notes Android UBSAN crashes, but does not show confirmed exploitation or a CVSS score.
Executive priority
Treat as a kernel maintenance priority, not an emergency based on current evidence. Patch through normal expedited kernel update channels for affected Linux and Android-derived assets, with higher priority for internet-scale fleets and devices where kernel crashes affect availability.
Technical view
In new_vmap_block(), a vmap_block was added to a per-CPU vmap_block_queue xarray before vb->cpu was initialized. Concurrent traversal, such as vm_unmap_aliases(), could use an uninitialized CPU index and access a remote queue out of bounds. The upstream fix initializes vb->cpu before xarray insertion.
Likely exposure
Exposure is limited to Linux kernels containing the vulnerable vmalloc change. Systems running affected 6.6/6.9/6.10-era kernels or vendor kernels derived from them should be reviewed, especially Android or highly concurrent SMP deployments.
Exploitation context
The bundle reports observed UBSAN array-index errors in Android. It does not cite CISA KEV, public exploitation, exploit code, remote reachability, privilege requirements, or attacker-controlled trigger conditions.
Researcher notes
Evidence supports a concurrency bug in Linux vmalloc queue handling with observed sanitizer failures. The record does not establish exploitability, impact beyond out-of-bounds access/crash, or affected downstream distributions. Validate against exact vendor kernel trees and backports rather than upstream version labels alone.
Mitigation direction
- Identify kernel versions and vendor backport status across fleets.
- Apply vendor kernel updates containing the referenced stable fixes.
- Prioritize Android, appliance, and cloud images with affected kernel branches.
- Monitor vendor advisories for distro-specific fixed package versions.
- Avoid deploying custom kernels lacking the vmalloc initialization fix.
Validation and detection
- Compare running kernels against vendor advisories and fixed stable commits.
- Review kernel changelogs for the vmap_block cpu initialization fix.
- Check crash telemetry for UBSAN out-of-bounds reports in purge_fragmented_block.
- Confirm updated images are deployed across rebooted hosts.
- Track exceptions where vendor fix status is not yet published.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-46847 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/1b2770e27d6d952f491bb362b657e5b2713c3efdCVE reference, Linux
- https://git.kernel.org/stable/c/6cf74e0e5e3ab5d5c9defb4c73dad54d52224671CVE reference, Linux
- https://git.kernel.org/stable/c/3e3de7947c751509027d26b679ecd243bc9db255CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.