Security readout for executives and security teams
Plain-English summary
CVE-2024-50150 is a Linux kernel USB Type-C memory lifetime bug. A local, low-privileged user could potentially cause serious confidentiality, integrity, or availability impact. The provided sources do not show active exploitation, and this is not described as remotely exploitable.
Executive priority
Treat this as high-priority kernel maintenance where local users or USB-C capable Linux systems exist. It is less urgent than a remotely exploitable internet-facing flaw, but the impact rating is high and kernel memory safety issues can be operationally serious.
Technical view
The bug is a use-after-free in Type-C alternate mode device release handling. The release path referenced the parent device without holding a reference. The kernel fix gets the parent reference during alternate mode registration and releases it in the release function. KASAN evidence in the record shows slab-use-after-free during delayed kobject cleanup.
Likely exposure
Exposure is most relevant to Linux systems using affected kernel branches with USB Type-C alternate mode support. Multi-user Linux hosts, workstations, and systems where untrusted users have local access deserve priority. The provided bundle has incomplete version boundary detail, so confirm exact exposure against vendor kernel advisories.
Exploitation context
CVSS is 7.8 with local attack vector, low complexity, low privileges, and no user interaction. The bundle marks KEV as false and provides no cited evidence of exploitation in the wild. Trigger conditions beyond the kernel object lifecycle issue are not fully documented here.
Researcher notes
Focus validation on kernel branch provenance and whether the Type-C alternate mode parent reference fix is present. The supplied record supports CWE-416 and high CVSS impact, but it does not provide a public exploit, KEV listing, or complete distro-by-distro affected matrix.
Mitigation direction
- Update Linux kernels using vendor or distribution packages that include the referenced stable fixes.
- Prioritize systems with untrusted local users or USB Type-C functionality exposed.
- Check Debian LTS guidance if running Debian-derived kernels covered by the advisories.
- Check hardware or appliance vendor guidance for bundled Linux kernels.
- Avoid ad hoc kernel backports unless they match the stable fix behavior.
Validation and detection
- Inventory Linux kernel versions and distribution package release levels across affected systems.
- Map kernels to vendor advisories and the referenced stable commit IDs.
- Confirm patched systems boot the expected updated kernel, not an older fallback kernel.
- Review vulnerability scanner findings for stale kernel package detection.
- For custom kernels, confirm the parent device reference fix is present.
Public sources used
- CVE Program
- CVE List V5
- Linux stable commit 2b0b33e8
- Linux stable commit 2c15c413
- Linux stable commit 6af43ec3
- Linux stable commit 87474406
- Linux stable commit bee1b68c
- Linux stable commit 1ded6b12
- Linux stable commit 68a7c7fe
- Linux stable commit befab3a2
- Debian LTS announcement January 2025
- Debian LTS announcement March 2025
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-416: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2024-50150 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/2b0b33e8a58388fa9078f0fbe9af1900e6b08879CVE reference, Linux
- https://git.kernel.org/stable/c/2c15c4133d00f5da632fce60ed013fc31aa9aa58CVE reference, Linux
- https://git.kernel.org/stable/c/6af43ec3bf40f8b428d9134ffa7a291aecd60da8CVE reference, Linux
- https://git.kernel.org/stable/c/87474406056891e4fdea0794e1f632b21b3dfa27CVE reference, Linux
- https://git.kernel.org/stable/c/bee1b68cb8bcee4fd3a8bde3a4886e0b1375dc4dCVE reference, Linux
- https://git.kernel.org/stable/c/1ded6b12499e6dee9b0e1ceac633be36538f6fc2CVE reference, Linux
- https://git.kernel.org/stable/c/68a7c7fe322546be1464174c8d85874b8161dedaCVE reference, Linux
- https://git.kernel.org/stable/c/befab3a278c59db0cc88c8799638064f6d3fd6f8CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/03/msg00002.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.htmlCVE reference, CVE
- https://cert-portal.siemens.com/productcert/html/ssa-265688.htmlCVE reference, siemens-SADP
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use After Free
Use After Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.