Security readout for executives and security teams
Plain-English summary
A Linux kernel bug can leak a small allocation when BPF filesystem mount options are parsed. Repeated triggering could consume kernel memory and affect availability. The supplied record rates it high severity, but does not demonstrate data theft, modification, privilege escalation, or real-world exploitation.
Executive priority
Prioritize routine expedited patching, especially for multi-user or untrusted-workload Linux hosts. This is not supported as an emergency internet-exploited issue, but a locally reachable kernel memory leak can threaten service stability. Escalate urgency if vendor guidance identifies broader impact or monitoring shows memory exhaustion.
Technical view
bpf_parse_param() overwrites or fails to preserve param->string, preventing later release of memory allocated through the fsconfig path. This is classified as CWE-401. The cited kernel commits preserve the pointer for cleanup. The supplied evidence demonstrates a kernel memory leak; it does not explain the CVSS vector’s claimed confidentiality and integrity impacts.
Likely exposure
Exposure is limited to Linux systems running releases identified as affected in the supplied record, including 6.9, 6.11.6, and 6.12. The CVSS vector indicates local access and low privileges are required. Downstream distributions may backport the fix, so version numbers alone are insufficient.
Exploitation context
CISA KEV status is false, and the supplied sources provide no evidence of active exploitation or a public exploit. The demonstrated behavior is an unreferenced kernel allocation reached through fsconfig and BPF mount-option parsing. Practical impact depends on whether an attacker can repeatedly reach that local kernel path.
Researcher notes
The record supplies CVSS 7.8 with high confidentiality, integrity, and availability impacts, yet its technical description only substantiates a small memory leak. No privilege-escalation or disclosure mechanism is provided. The affected-version representation is also incomplete or ambiguous; confirm precise branch boundaries and backports through Linux or distribution advisories.
Mitigation direction
- Install a vendor-supported kernel update containing the applicable cited stable fix.
- Check distribution advisories because vendors may backport fixes without changing to an upstream version.
- Restrict unnecessary local account and workload access until affected systems are updated.
- Prioritize shared or multi-user systems where untrusted users can exercise local kernel interfaces.
Validation and detection
- Inventory running kernel versions and compare them with vendor CVE advisories.
- Confirm the installed kernel changelog includes CVE-2024-50165 or an applicable cited fix commit.
- Verify systems booted into the corrected kernel after updating.
- Monitor kernel memory pressure and unexplained allocation growth while remediation is pending.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-401: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2024-50165 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/5d7a0a426540319327309035509cb768a2f5c2c4CVE reference, Linux
- https://git.kernel.org/stable/c/1f97c03f43fadc407de5b5cb01c07755053e1c22CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Missing Release of Memory after Effective Lifetime
Missing Release of Memory after Effective Lifetime represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.