Security readout for executives and security teams
Plain-English summary
A Linux kernel cleanup error could reference freed memory in the IAA compression subsystem. Although the CVSS score is 7.0, the kernel description says the vulnerable callback was unimplemented and the path was effectively dead code. Current practical risk therefore appears limited, but supported kernels should still receive the applicable stable update.
Executive priority
Schedule remediation through routine high-severity kernel patching, prioritizing hosts that use IAA compression or permit untrusted local users. Emergency action is not supported by the provided evidence because the vulnerable callback was reportedly unimplemented and no exploitation evidence is cited. Track vendor advisories in case downstream implementations change exposure.
Technical view
free_device_compression_mode() freed device_mode before passing it to a later compression-mode free callback, creating a potential use-after-free. The supplied assessment describes that callback as unimplemented, making the affected path dead code at disclosure. The vector requires local access, low privileges, and high attack complexity, with theoretical confidentiality, integrity, and availability impact.
Likely exposure
The bundle marks Linux kernel versions 6.8, 6.10.13, 6.11.2, and 6.12 as affected. Exposure depends on the IAA crypto subsystem and downstream backports. The supplied version records are ambiguous, so organizations should compare their exact vendor kernel build against the referenced stable fixes rather than relying only on version numbers.
Exploitation context
No active exploitation is supported by the supplied sources, and the CVE is not listed as KEV. Exploitation is scored as local, high-complexity, and requiring low privileges without user interaction. The kernel maintainer’s description indicates the use-after-free occurred in dead code because no implementation used the relevant free callback.
Researcher notes
The defect is a lifetime-ordering error: device_mode is freed before a later callback receives the same pointer. Practical reachability was reportedly absent at disclosure because the callback had no implementation. Researchers should verify downstream kernels for callback implementations, altered reachability, and backported fixes without assuming upstream dead-code conditions apply everywhere.
Mitigation direction
- Apply a supported vendor kernel update containing the applicable referenced stable fix.
- Prioritize systems using or enabling the Linux IAA compression subsystem.
- Consult distribution guidance for backported fixes and exact corrected package versions.
- Use normal change controls and reboot if required to activate the updated kernel.
Validation and detection
- Inventory running kernel builds and identify systems matching the supplied affected versions.
- Determine whether the IAA crypto compression subsystem is configured or used.
- Confirm vendor packages contain one of the applicable stable fixes or an equivalent backport.
- After updating, verify systems are running the corrected kernel build.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-47732 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H15.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7HighVector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/b5d534b473e2c8d3e4560be2dd6c12a8eb9d61e9CVE reference, Linux
- https://git.kernel.org/stable/c/c66f0be993ba52410edab06124c54ecf143b05c1CVE reference, Linux
- https://git.kernel.org/stable/c/e0d3b845a1b10b7b5abdad7ecc69d45b2aab3209CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.