Security readout for executives and security teams
Plain-English summary
A Linux kernel race can leave networking code using memory after its module begins unloading. A local low-privileged attacker could potentially exploit this memory-safety flaw to crash the system or compromise kernel confidentiality and integrity. Practical exploitation is not established by the supplied sources.
Executive priority
Treat as a high-priority kernel maintenance issue, especially on shared or locally accessible Linux systems. Schedule tested vendor kernel updates promptly. Emergency action is more appropriate if exposed systems permit untrusted local access or show related kernel warnings; supplied evidence does not justify claiming active exploitation.
Technical view
Concurrent ip6table_nat module unloading and netfilter get_info() handling can return a table without securing its module reference. A subsequent module_put() may access freed memory. The kernel fix rechecks the module while traversing the per-network table list. This is classified as CWE-416 with CVSS 3.1 score 7.8.
Likely exposure
Exposure concerns Linux systems on affected kernel branches where IPv6 netfilter and ip6table_nat are present and local users can reach the relevant interface. The supplied version metadata identifies affected 5.15, 6.1, 6.6, 6.11, and 6.12 branch entries, but is insufficient for definitive distribution-package mapping.
Exploitation context
The CVSS vector describes local access, low privileges, low complexity, and no user interaction, with potentially high confidentiality, integrity, and availability impact. The documented trigger involves concurrent module unloading and get_info() execution. This CVE is not listed as KEV, and the supplied sources do not report active exploitation or a public exploit.
Researcher notes
The disclosure demonstrates a race-triggered reference-management failure and warning under QEMU, but does not establish reliable privilege escalation or other practical exploitation. Exact affected and fixed distribution package versions cannot be derived from the condensed version entries alone. Validate ancestry or vendor backports rather than relying only on displayed version strings.
Mitigation direction
- Upgrade to a vendor-supported kernel package containing the referenced upstream fix.
- Check distribution advisories for the exact corrected package applicable to each deployed kernel.
- Prioritize multi-user systems and hosts where IPv6 netfilter modules are used.
- Restrict unnecessary local account access while remediation is pending.
Validation and detection
- Inventory running kernel versions and map them against vendor advisories.
- Determine whether ip6table_nat and IPv6 netfilter functionality are enabled or used.
- Confirm the installed kernel includes the applicable upstream stable fix.
- Reboot into the corrected kernel and verify the running version.
- Review kernel logs for module_put warnings involving get_info or ip6table_nat.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-416: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2024-50257 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9CISA-ADPCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H15.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base CVSS 3.1 score
7HighVector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/ba22ea01348384df19cc1fabc7964be6e7189749CVE reference, Linux
- https://git.kernel.org/stable/c/cb7c388b5967946f097afdb759b7c860305f2d96CVE reference, Linux
- https://git.kernel.org/stable/c/6a1f088f9807f5166f58902d26246d0b88da03a8CVE reference, Linux
- https://git.kernel.org/stable/c/bab3bb35c03b263c486833d50d50c081d9e9832bCVE reference, Linux
- https://git.kernel.org/stable/c/f48d258f0ac540f00fa617dac496c4c18b5dc2faCVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use After Free
Use After Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.