Security readout for executives and security teams
Plain-English summary
A Linux MACsec hardware-offload flaw can leave network metadata in use after it has been freed. The demonstrated result is an invalid kernel-memory read during packet transmission. Because kernel memory corruption can threaten confidentiality, integrity, and availability, affected systems should be patched, although practical exploitation is not established by the supplied sources.
Executive priority
Treat this as a high-priority kernel maintenance issue for systems using MACsec offload, particularly exposed or high-value infrastructure. Broader emergency action is not justified by the supplied exploitation evidence. Confirm affected configurations and schedule vendor kernel updates promptly.
Technical view
During MACsec network-device teardown, metadata_dst holding the Secure Channel Identifier could be freed while an skb still referenced it. A hardware driver could subsequently access the released object during transmission, producing a KASAN-detected use-after-free. The fix replaces immediate metadata_dst_free() handling with reference-aware dst_release().
Likely exposure
Exposure requires an affected Linux kernel and MACsec hardware-offload activity. The reported trace involves the mlx5 driver, but the sources do not establish that exposure is exclusive to mlx5. Distribution backports make kernel version strings insufficient for determining patch status.
Exploitation context
The CVSS vector indicates local access and low privileges are required. The supplied evidence documents a KASAN-detected failure, not a working exploit. This CVE is not identified as KEV, and no cited source reports active exploitation. Remote, unauthenticated exploitation is not supported by the evidence.
Researcher notes
The evidence demonstrates a lifetime-management defect: teardown frees metadata_dst before outstanding skb references finish. The patch changes release semantics to reference counting. The trace shows mlx5e_xmit reading freed memory, but the sources do not demonstrate controlled corruption, privilege escalation, code execution, or driver exclusivity.
Mitigation direction
- Install a vendor-supported kernel containing the applicable referenced stable fix.
- Confirm distribution backport status instead of relying only on the displayed kernel version.
- Prioritize systems using MACsec hardware offload or mlx5 networking.
- Follow vendor reboot guidance to ensure the corrected kernel is running.
Validation and detection
- Inventory running kernel builds across Linux systems, including distribution revision numbers.
- Identify systems configured for MACsec and hardware offload.
- Map each kernel build to vendor advisories or the referenced stable commits.
- After updating, verify the running kernel changed and monitor for related KASAN or kernel errors.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-416: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2024-50261 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/872932cf75cf859804370a265dd58118129386faCVE reference, Linux
- https://git.kernel.org/stable/c/9f5ae743dbe9a2458540a7d35fff0f990df025cfCVE reference, Linux
- https://git.kernel.org/stable/c/4614640f1d5c93c22272117dc256e9940ccac8e8CVE reference, Linux
- https://git.kernel.org/stable/c/f1e54d11b210b53d418ff1476c6b58a2f434dfc0CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use After Free
Use After Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.