Security readout for executives and security teams
Plain-English summary
A local, low-privileged user can exploit a race in Linux’s Intel Xe graphics virtual-memory handling, causing memory to be reused while still referenced. This may allow system compromise or disruption. Network access alone is insufficient.
Executive priority
Prioritize affected multi-user workstations, shared compute hosts, and systems running untrusted local workloads. Internet-facing status alone does not increase direct reachability, but successful local exploitation could produce full system impact. Patch promptly after confirming driver and kernel exposure.
Technical view
The Xe DRM VM creation path exposed a predictable VM identifier before creation completed. A concurrent destroy request could remove that VM while the create operation still referenced it, causing a use-after-free. The fix delays xarray identifier allocation until the end of creation.
Likely exposure
Exposure is most likely on systems running an affected Linux kernel with the Intel Xe DRM driver and compatible graphics hardware, where untrusted local users or workloads can access its VM ioctls. The supplied version data identifies Linux 6.8 through 6.11.3 and 6.12, but downstream kernel status requires vendor confirmation.
Exploitation context
The supplied CVSS 3.1 score is 7.8: local access, low complexity, low privileges, no user interaction, and potentially high confidentiality, integrity, and availability impact. The source describes a malicious local user, but provides no evidence of exploitation in the wild; this CVE is not marked KEV.
Researcher notes
The vulnerable lifecycle ordering permits VM destruction before the create ioctl releases its reference. The correction moves xa_alloc to the end, preventing publication of the identifier during incomplete initialization. No CWE is supplied. Exact downstream exposure and fixed versions cannot be established from the bundle alone.
Mitigation direction
- Install a vendor-supported kernel containing the referenced Xe DRM fix.
- Check distribution or appliance advisories for exact fixed package versions.
- Restrict untrusted local access to affected systems until updates are applied.
- Where operationally acceptable, limit access to the Xe graphics device pending remediation.
Validation and detection
- Inventory running kernel versions and identify systems using the Intel Xe DRM driver.
- Confirm whether untrusted users or workloads can access the relevant graphics device.
- Compare vendor kernel changelogs or commit ancestry with the referenced stable fixes.
- After updating, verify the fixed kernel is running, including after reboot.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-49865 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/09cf8901fc0225898311b375cfcc67bae37ed5daCVE reference, Linux
- https://git.kernel.org/stable/c/74231870cf4976f69e83aa24f48edb16619f652fCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.