Security readout for executives and security teams
Plain-English summary
A Linux timing tracer can mishandle a processor being removed while background setup is underway. This may place a timing thread on the wrong CPU and corrupt high-resolution timer state. The CVSS vector describes a local vulnerability, so risk is concentrated on affected systems permitting low-privileged local access and exercising tracing or CPU hotplug.
Executive priority
Treat this as a high-priority local kernel patch, not an internet-facing emergency. Accelerate remediation on multi-user hosts and systems using tracing or CPU hotplug. Require distributor confirmation because backported fixes can make simple version checks misleading.
Technical view
Asynchronous osnoise CPU-online processing can race with CPU-offline processing. A worker may start the timerlat kernel thread after its intended CPU has left the online mask, causing incorrect scheduling and high-resolution timer corruption. The Linux fix skips online processing when the CPU is already offline.
Likely exposure
The supplied affected data identifies Linux kernel lines from 5.14 through 6.12, but its flattened version entries do not establish reliable boundaries. Exposure is more plausible where osnoise or timerlat tracing, CPU hotplug, and low-privileged local access coexist. Distribution backports may change version-based conclusions.
Exploitation context
CISA KEV status is false, and no supplied source reports active exploitation. CVSS 3.1 scores this 7.8 with local access, low privileges, low complexity, and no user interaction. The evidence demonstrates a diagnostic warning and timer corruption in QEMU, not a successful security compromise.
Researcher notes
No CWE is supplied. The root cause is a CPU-hotplug ordering race between asynchronous online work and offline processing. Exact affected ranges and practical attacker-controlled reachability are not fully demonstrated in the bundle. Assess code presence, feature use, local privilege boundaries, and distribution backports without inferring remote exposure.
Mitigation direction
- Apply a vendor kernel update incorporating the applicable Linux stable fix.
- Consult the operating-system distributor for exact fixed package and backport status.
- Until updated, reduce untrusted local access where operationally practical.
- Avoid unnecessary timerlat or osnoise activity during CPU hotplug where operationally safe.
Validation and detection
- Record the running kernel version and compare it with the distributor's CVE guidance.
- Confirm the installed kernel contains the applicable referenced stable fix.
- Reboot after updating and verify the corrected kernel is running.
- Review kernel logs for timerlat, hrtimer, debugobjects, or CPU-hotplug warnings.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-49866 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/322920b53dc11f9c2b33397eb3ae5bc6a175b60dCVE reference, Linux
- https://git.kernel.org/stable/c/ce25f33ba89d6eefef64157655d318444580fa14CVE reference, Linux
- https://git.kernel.org/stable/c/a6e9849063a6c8f4cb2f652a437e44e3ed24356cCVE reference, Linux
- https://git.kernel.org/stable/c/a0d9c0cd5856191e095cf43a2e141b73945b7716CVE reference, Linux
- https://git.kernel.org/stable/c/f72b451dc75578f644a3019c1489e9ae2c14e6c4CVE reference, Linux
- https://git.kernel.org/stable/c/829e0c9f0855f26b3ae830d17b24aec103f7e915CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.