Security readout for executives and security teams
Plain-English summary
A timing flaw in the Linux mlx5 RDMA driver can leave background work running after its device is unregistered. That work may access invalid state and crash the kernel, disrupting affected servers. The supplied evidence demonstrates a kernel panic; it does not demonstrate data theft or alteration.
Executive priority
Treat this as a high-priority availability risk for RDMA-dependent infrastructure, especially clustered, storage, compute, or virtualized workloads using mlx5_ib. Patch through supported kernel channels after normal compatibility testing. Systems without this driver or RDMA use are lower priority pending inventory confirmation.
Technical view
CVE-2024-53224 is a CWE-476 NULL-pointer dereference caused by a race between mlx5_ib device deregistration and pkey-change work. The fix reorders notifier registration and cleanup so the notifier is removed before the RDMA device. The supplied CVSS 3.1 score is 8.8 (high).
Likely exposure
Exposure is limited to Linux systems using the mlx5_ib RDMA driver and vulnerable kernel code during relevant device cleanup and pkey-change activity. The bundle’s flattened version list does not clearly define affected ranges, so distribution package status and fix backports require vendor confirmation.
Exploitation context
The record is not in KEV, and the supplied sources provide no evidence of active exploitation or a public exploit. They document a race-triggered kernel panic. Practical trigger conditions and repeatability are not fully established in the bundle.
Researcher notes
The demonstrated failure is a NULL dereference in setup_qp reached through mlx5_ib_gsi_pkey_change after device unregistration. The remediation changes lifecycle ordering and moves pkey work handling into the notifier stage. Although the CVSS vector claims high confidentiality, integrity, and availability impact, the supplied technical evidence directly substantiates only a kernel panic.
Mitigation direction
- Install a vendor-supported kernel containing the applicable upstream stable fix.
- Prioritize mlx5_ib RDMA hosts where device removal, reconfiguration, or pkey changes occur.
- Check distribution guidance because kernel package versions may contain backported fixes.
- If immediate updating is impossible, request vendor-supported mitigations; none are named in the bundle.
Validation and detection
- Inventory kernel versions and identify systems loading or using mlx5_ib.
- Confirm the installed kernel includes an applicable referenced stable commit or vendor backport.
- Review kernel logs for mlx5_ib pkey_change_handler NULL-pointer panics.
- Verify notifier cleanup precedes device deregistration in any locally maintained backport.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-476: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2024-53224 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H2.85.9LinuxCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
8.8HighVector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/921fcf2971a1e8d3b904ba2c2905b96f4ec3d4adCVE reference, Linux
- https://git.kernel.org/stable/c/542bd62b7a7f37182c9ef192c2bd25d118c144e4CVE reference, Linux
- https://git.kernel.org/stable/c/6b0acf6a94c31efa43fce4edc22413a3390f9c05CVE reference, Linux
- https://git.kernel.org/stable/c/ede132a5cf559f3ab35a4c28bac4f4a6c20334d8CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
NULL Pointer Dereference
NULL Pointer Dereference represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.