Security readout for executives and security teams
Plain-English summary
CVE-2024-50127 is a Linux kernel memory-safety flaw in the TAPRIO network scheduler. A local user with some privileges could potentially trigger a use-after-free, with high confidentiality, integrity, and availability impact per CVSS. The bundle does not show active exploitation.
Executive priority
Prioritize normal high-severity kernel patching, especially for shared Linux hosts, multi-user systems, and operational technology assets. Urgency is reduced by local attack requirements and no KEV evidence, but impact is high if an attacker already has local access.
Technical view
The issue is a CWE-416 use-after-free in net sched taprio_change(). The admin pointer can become dangling during schedule switch or removal by advance_sched(); the existing q->current_entry_lock section was too small. Stable kernel fixes replace rcu_assign_pointer() with rcu_replace_pointer() before scheduled freeing.
Likely exposure
Exposure is mainly Linux systems running affected kernel versions with the relevant traffic-control scheduler code reachable. Debian LTS and Siemens references indicate downstream tracking, but the bundle does not provide full product-level exposure details.
Exploitation context
The CVSS vector is local, low complexity, low privileges, no user interaction, with high impact to confidentiality, integrity, and availability. The source bundle marks KEV as false and provides no cited evidence of public exploitation.
Researcher notes
Key uncertainty is reachability in specific deployments. The bundle identifies the root cause and stable fixes, but not exploit availability, required kernel configuration, or product-specific Siemens impact. Validate by kernel branch and vendor backport, not only upstream version strings.
Mitigation direction
- Update affected Linux kernels using vendor-supported packages or stable kernel fixes.
- For Debian LTS systems, apply the referenced Debian security updates.
- For Siemens environments, review SSA-265688 for product-specific status and guidance.
- Restrict local shell access and administrative network-configuration privileges where feasible.
- Track vendor advisories for backported fixes matching deployed kernel branches.
Validation and detection
- Inventory Linux kernel versions across servers, appliances, and embedded systems.
- Check whether deployed kernels include the referenced stable commits or vendor backports.
- Review Debian LTS advisory applicability for Debian-based assets.
- Review Siemens SSA-265688 for affected product mapping in OT environments.
- Confirm vulnerability scanners are using CVE data updated after 2026-05-12.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-416: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2024-50127 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/2f868ce6013548a713c431c679ef73747a66fcf3CVE reference, Linux
- https://git.kernel.org/stable/c/8a283a19026aaae8a773fd8061263cfa315b127fCVE reference, Linux
- https://git.kernel.org/stable/c/999612996df28d81f163dad530d7f8026e03aec6CVE reference, Linux
- https://git.kernel.org/stable/c/fe371f084073e8672a2d7d46b335c3c060d1e301CVE reference, Linux
- https://git.kernel.org/stable/c/0d4c0d2844e4eac3aed647f948fd7e60eea56a61CVE reference, Linux
- https://git.kernel.org/stable/c/2240f9376f20f8b6463232b4ca7292569217237fCVE reference, Linux
- https://git.kernel.org/stable/c/f504465970aebb2467da548f7c1efbbf36d0f44bCVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/03/msg00002.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.htmlCVE reference, CVE
- https://cert-portal.siemens.com/productcert/html/ssa-265688.htmlCVE reference, siemens-SADP
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use After Free
Use After Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.