Security readout for executives and security teams
Plain-English summary
A Linux graphics-driver race can free a GPU job while another kernel thread still uses it. This use-after-free could let a locally authenticated user crash the system or potentially compromise confidentiality and integrity. The supplied CVSS score is 7.8 (High).
Executive priority
Prioritize remediation on multi-user workstations, shared compute systems, and other hosts granting untrusted local access to affected GPU functionality. Treat as a high-priority kernel update, but not an internet-wide emergency: exploitation requires local access, and no active exploitation is established by the supplied evidence.
Technical view
CVE-2024-50149 is a CWE-416 use-after-free in Linux drm/xe timeout detection and recovery. TDR could pass the run_job thread and free a job prematurely. The correction leaves job freeing to the scheduler and places the job on a pending list instead.
Likely exposure
Exposure is limited to systems running an affected Linux kernel with the drm/xe driver and relevant GPU job/TDR paths reachable. The supplied version data identifies Linux 6.10 through entries involving 6.11.6 and 6.12, but its exact range is ambiguous; confirm against distribution guidance and fix-commit inclusion.
Exploitation context
The CVSS vector indicates local access, low complexity, low privileges, and no user interaction, with potentially high confidentiality, integrity, and availability impact. CISA KEV status is false, and the supplied sources provide no evidence of active exploitation or a public exploit.
Researcher notes
The central concurrency issue is unsafe job release during TDR racing beyond run_job, producing a potential dangling reference. The fix changes lifetime handling rather than merely adding a check. Precise vulnerable and fixed release boundaries cannot be established confidently from the supplied version entries alone; verify commit ancestry or distribution backports.
Mitigation direction
- Install a vendor-supported kernel containing the referenced stable fix.
- Consult the Linux distribution's advisory for exact affected and fixed package versions.
- Prioritize shared or multi-user systems where untrusted local users can access the GPU.
- Reboot into the corrected kernel after installation.
Validation and detection
- Record the running kernel version on potentially exposed systems.
- Confirm whether the drm/xe driver and relevant Intel GPU hardware are in use.
- Verify the installed kernel includes either referenced stable fix commit.
- After remediation, confirm the corrected kernel is running, not merely installed.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-416: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2024-50149 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/be8fe75e57f8fa3f87e3b1c283cc7cd9f9b80867CVE reference, Linux
- https://git.kernel.org/stable/c/82926f52d7a09c65d916c0ef8d4305fc95d68c0cCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use After Free
Use After Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.