Security readout for executives and security teams
Plain-English summary
A local, low-privileged user may trigger a timing flaw in the Linux Panthor graphics driver while a group object is being removed. The resulting object-lifetime error could compromise confidentiality, integrity, or availability. Risk is limited to systems running affected kernels where the Panthor driver is present and reachable.
Executive priority
Treat as a high-priority kernel maintenance issue on systems using Panthor, especially shared or locally accessible hosts. It is not evidenced as an emergency internet-wide threat because exploitation requires local privileges and active exploitation is unconfirmed. Patch promptly through normal expedited kernel-update processes.
Technical view
CVE-2024-50174 is a CWE-362 race between retrieving a group pointer from an XArray and incrementing its reference count while another path may erase it. The fix holds the XArray lock during the reference-count increment. CVSS 3.1 is 7.8: local access, low complexity, low privileges, no user interaction, with high potential impact.
Likely exposure
Exposure is most likely on Linux systems using the drm/panthor driver and an affected kernel build. The supplied version data names 6.10, 6.10.14, 6.11.3, and 6.12, but its exact range boundaries are unclear. Confirm status through distribution advisories and backport records rather than version numbers alone.
Exploitation context
The supplied CVSS vector requires local access and low privileges; it does not describe a remote attack. The bundle marks the CVE as absent from KEV and provides no evidence of active exploitation or a public exploit. Practical exploitability beyond the documented race is therefore unconfirmed.
Researcher notes
The core issue is a pointer-lifetime race outside the XArray's structural protection: lookup and reference acquisition were not atomic relative to xa_erase(). The stable fix extends XArray locking across reference acquisition. The source bundle's flattened affected-version list is ambiguous, so commit ancestry and distribution backport evidence are stronger validation signals.
Mitigation direction
- Install a vendor-supported kernel update containing the referenced stable fix or its documented backport.
- Prioritize shared systems where untrusted local users can access the Panthor graphics driver.
- If immediate updating is impossible, consult the Linux distribution or hardware vendor for supported interim guidance.
Validation and detection
- Inventory running kernel builds and determine whether the Panthor driver is present and active.
- Compare each build against distribution advisories and backport records for CVE-2024-50174.
- Confirm the kernel changelog includes a referenced fix commit or an explicitly documented equivalent.
- After updating and rebooting, verify the corrected kernel build is running.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-362: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2024-50174 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H13.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base CVSS 3.1 score
4.7MediumVector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/8a585d553c11965332d7a2d74e79ef92a42bfc87CVE reference, Linux
- https://git.kernel.org/stable/c/44742138d151c3a945460ae7beff8ae45ac0bf58CVE reference, Linux
- https://git.kernel.org/stable/c/cac075706f298948898b1f63e81709df42afa75dCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.