Security readout for executives and security teams
Plain-English summary
A cleanup race in Linux's pxafb framebuffer driver can let delayed work access memory after it has been freed during driver removal. This may crash or corrupt the kernel, with potential confidentiality, integrity, and availability impact. The documented runtime trigger requires root access.
Executive priority
Include this in the high-severity kernel patch cycle and accelerate remediation for systems actively using pxafb. Based on supplied evidence, it is not a remote unauthenticated emergency. Root-only triggering and specialized driver exposure reduce fleet-wide urgency, but affected operational or embedded systems should not be ignored.
Technical view
During pxafb removal, framebuffer cleanup can free fbi->fb while previously scheduled pxafb_task work still references it through controller and LCD power handling. This creates a use-after-free race. The stable-kernel fix cancels the queued work before cleanup proceeds.
Likely exposure
Exposure is limited to Linux systems containing the affected pxafb framebuffer code, particularly where the driver is used and can be removed at runtime. The supplied version data spans multiple kernel lines, but distribution backports may alter actual status. Confirm against vendor packages and fix commits.
Exploitation context
CISA KEV status is false, and the supplied sources do not report active exploitation or a public exploit. The documented trigger involves root removing the driver while scheduled work remains. Remote exposure is not established; practical risk is local, administrative, and configuration-dependent.
Researcher notes
The race is teardown-specific: unregister_framebuffer can release fbi->fb while pxafb_task dereferences it through controller or power handling. Remediation orders work cancellation before cleanup. The bundle provides no CWE assignment, exploitation proof, or universal package mapping; assess downstream kernels by vendor confirmation or equivalent backport review.
Mitigation direction
- Install a vendor kernel update containing the applicable stable-kernel fix.
- Confirm downstream vendor guidance because distributions may backport fixes without changing the upstream version number.
- Until patched, avoid runtime pxafb removal where feasible; this reduces the documented trigger but is not complete remediation.
- Restrict root access and module-management privileges as defense in depth.
Validation and detection
- Inventory kernel packages and determine whether pxafb is built, available, or loaded.
- Map installed kernels to the affected ranges and stable fix commits in the CVE record.
- Confirm vendor kernels include the relevant backport rather than relying only on version strings.
- After updating, verify the intended kernel boots and contains the pxafb work-cancellation fix.
- Review privileged module-removal controls and logs for unexpected pxafb unload activity.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-49924 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/e657fa2df4429f3805a9b3e47fb1a4a1b02a72bdCVE reference, Linux
- https://git.kernel.org/stable/c/6d0a07f68b66269e167def6c0b90a219cd3e7473CVE reference, Linux
- https://git.kernel.org/stable/c/e6897e299f57b103e999e62010b88e363b3eebaeCVE reference, Linux
- https://git.kernel.org/stable/c/4cda484e584be34d55ee17436ebf7ad11922b97aCVE reference, Linux
- https://git.kernel.org/stable/c/3c0d416eb4bef705f699213cee94bf54b6acdacdCVE reference, Linux
- https://git.kernel.org/stable/c/fdda354f60a576d52dcf90351254714681df4370CVE reference, Linux
- https://git.kernel.org/stable/c/aaadc0cb05c999ccd8898a03298b7e5c31509b08CVE reference, Linux
- https://git.kernel.org/stable/c/a3a855764dbacbdb1cc51e15dc588f2d21c93e0eCVE reference, Linux
- https://git.kernel.org/stable/c/4a6921095eb04a900e0000da83d9475eb958e61eCVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.