Security readout for executives and security teams
Plain-English summary
This Linux kernel issue can trigger a false memory-safety alarm in the kernel allocator on systems using Memory Tagging Extension. The practical business risk is availability: affected systems may fault or fail during kernel activity rather than expose data.
Executive priority
Treat as a moderate availability issue. Patch through normal kernel maintenance, with higher priority for systems where local users, workloads, or kernel faulting could disrupt critical services.
Technical view
The flaw is in __do_krealloc zeroing spare memory after commit 1a83a716ec233. The code did not reset the KASAN tag before memset, causing a pointer tag and memory tag mismatch and a reported slab-out-of-bounds condition under MTE.
Likely exposure
Exposure is Linux kernel deployments carrying the affected allocator change, especially ARM/MTE and KASAN-tagged configurations. The bundle lists stable Linux fixes and Debian LTS advisories, but exact vulnerable package ranges should be confirmed against the running distribution kernel.
Exploitation context
The CVSS vector is local, low complexity, low privileges, no user interaction, with availability impact only. The source bundle does not show KEV listing or cited evidence of active exploitation.
Researcher notes
The evidence describes a false positive KASAN slab-out-of-bounds report caused by tag mismatch during memset in __do_krealloc. The bundle does not support claims of confidentiality impact, integrity impact, remote attack, or active exploitation.
Mitigation direction
- Upgrade to vendor kernel releases containing the referenced stable fixes.
- Use Debian LTS advisories if running Debian-packaged kernels.
- Prioritize systems where kernel availability is operationally critical.
- Check vendor guidance before applying non-distribution kernel patches.
Validation and detection
- Inventory running Linux kernel versions and vendor package revisions.
- Compare kernels against the referenced stable commits and Debian advisories.
- Identify ARM/MTE or KASAN-tagged testing and production configurations.
- Review kernel logs for matching KASAN MTE tag mismatch reports.
Public sources used
- CVE Program
- CVE List V5
- Linux stable commit 8ebee7565eff
- Linux stable commit d02492863023
- Linux stable commit d43f1430d47c
- Linux stable commit 486aeb5f1855
- Linux stable commit 71548fada7ee
- Linux stable commit 3dfb40da84f2
- Linux stable commit 704573851b51
- Debian LTS announcement March 2025
- Debian LTS announcement January 2025
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-53097 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/8ebee7565effdeae6085458f8f8463363120a871CVE reference, Linux
- https://git.kernel.org/stable/c/d02492863023431c31f85d570f718433c22b9311CVE reference, Linux
- https://git.kernel.org/stable/c/d43f1430d47c22a0727c05b6f156ed25fecdfeb4CVE reference, Linux
- https://git.kernel.org/stable/c/486aeb5f1855c75dd810c25036134961bd2a6722CVE reference, Linux
- https://git.kernel.org/stable/c/71548fada7ee0eb50cc6ccda82dff010c745f92cCVE reference, Linux
- https://git.kernel.org/stable/c/3dfb40da84f26dd35dd9bbaf626a2424565b8406CVE reference, Linux
- https://git.kernel.org/stable/c/704573851b51808b45dae2d62059d1d8189138a2CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/03/msg00002.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.