Security readout for executives and security teams
Plain-English summary
A race condition in the Linux Intel Xe graphics driver can access a queue after memory has been freed. A local user with limited privileges could potentially trigger serious confidentiality, integrity, or availability impacts. Exposure depends on the running kernel, driver use, and relevant hardware.
Executive priority
Prioritize exposed multi-user systems and shared compute environments using the Xe driver. Remediate through normal high-severity kernel maintenance, accelerated where untrusted local users or workloads are present. Exact package applicability requires vendor confirmation.
Technical view
The GuC submission cleanup path can inspect a non-wedged queue while asynchronous destruction concurrently frees it at zero reference count, causing a use-after-free. The fix holds the submission_state lock during the wedge-status check, then releases it before put() to avoid deadlock.
Likely exposure
The supplied metadata identifies Linux 6.11-era kernels and lists 6.11.3 and 6.12 as boundaries, but does not preserve their range operators. Systems using the drm/xe driver warrant review; confirm exact affected packages through the CVE record and distribution guidance.
Exploitation context
The CVSS vector describes local, low-complexity exploitation requiring low privileges and no user interaction, with potentially high confidentiality, integrity, and availability impact. This CVE is not listed as KEV, and the supplied sources provide no evidence of active exploitation or a public exploit.
Researcher notes
The source describes a queue-lifetime race and resulting use-after-free in wedged_fini. No CWE is supplied. The linked stable commits are the authoritative fix references provided, while the flattened affected-version data is insufficient to establish exact range inclusivity independently.
Mitigation direction
- Apply a vendor-supported kernel update incorporating the appropriate referenced stable fix.
- Consult the Linux distribution or appliance vendor for exact affected and fixed package versions.
- Until updated, restrict untrusted local access on systems actively using the Intel Xe driver.
Validation and detection
- Record the running kernel version and vendor build on relevant Linux systems.
- Determine whether the drm/xe driver is present and active on relevant hardware.
- Confirm the installed kernel incorporates the appropriate linked stable fix.
- Verify the updated kernel is running after maintenance.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-49943 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/d88f9bab7e62dd0dbe983fa70cf040042a60cc84CVE reference, Linux
- https://git.kernel.org/stable/c/790533e44bfc7af929842fccd9674c9f424d4627CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.