Security readout for executives and security teams
Plain-English summary
A Linux drm/xe graphics-driver cleanup race can leave queued destruction work running after the driver has been removed. That stale work may access freed memory, potentially causing crashes or compromising confidentiality, integrity, and availability. Exploitation requires local, low-privileged access; no user interaction is required.
Executive priority
Treat as a high-priority kernel update on exposed multi-user or graphics-enabled Linux systems. It is less urgent where drm/xe is absent or local access is tightly controlled. No supplied evidence supports emergency incident response for active exploitation.
Technical view
Queue destruction was scheduled on a system workqueue that could outlive the drm/xe driver instance. During teardown, outstanding work could dereference freed objects, producing use-after-free faults. The correction adds a finalization stage that waits for the user-queue array to empty before draining destruction work.
Likely exposure
Exposure is limited to Linux systems running an affected kernel with the drm/xe driver in use. The supplied record lists 6.8, 6.10.14, 6.11.3, and 6.12 as affected, but its version data is ambiguous. Confirm distribution-specific status rather than relying solely on version strings.
Exploitation context
The CVSS 3.1 score is 7.8 with local access and low privileges required. CISA KEV status is false, and the supplied sources provide no evidence of active exploitation or a public exploit. Practical reach depends on local access and the affected driver being present and exercised.
Researcher notes
The vulnerable lifecycle crosses driver teardown and asynchronous workqueue execution. Relevant review areas include queue ownership, teardown ordering, waitqueue synchronization, and whether the queue array reaches empty before draining. The supplied record does not establish reliable affected ranges, exploitation reliability, or distribution-specific fixes.
Mitigation direction
- Apply a vendor-supported kernel containing the referenced drm/xe queue-destruction fix.
- Check distribution security advisories for corrected package versions and backports.
- Prioritize multi-user systems where untrusted local users can access graphics resources.
- Restrict unnecessary local accounts and graphics-device access while remediation is pending.
Validation and detection
- Inventory kernel versions and determine whether the drm/xe driver is loaded or used.
- Compare installed kernel packages with distribution advisories and referenced stable commits.
- Confirm the replacement kernel is active after updating and rebooting.
- Review kernel logs for use-after-free reports or drm/xe teardown faults.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-49876 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/272b0e78874586d6ccae04079d75b27b47705544CVE reference, Linux
- https://git.kernel.org/stable/c/421c74670b0f9d5c007f1276d3647aa58f407fdeCVE reference, Linux
- https://git.kernel.org/stable/c/2d2be279f1ca9e7288282d4214f16eea8a727cdbCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.