LiveActive security incident?Get immediate response
CVE Record

CVE-2024-56624: iommufd: Fix out_fput in iommufd_fault_alloc()

In the Linux kernel, the following vulnerability has been resolved: iommufd: Fix out_fput in iommufd_fault_alloc() As fput() calls the file->f_op->release op, where fault obj and ictx are getting released, there is no need to release these two after fput() one more time, which would result in imbalanced refcounts: refcount_t: decrement hit 0; leaking memory. WARNING: CPU: 48 PID: 2369 at lib/refcount.c:31 refcount_warn_saturate+0x60/0x230 Call trace: refcount_warn_saturate+0x60/0x230 (P) refcount_warn_saturate+0x60/0x230 (L) iommufd_fault_fops_release+0x9c/0xe0 [iommufd] ... VFS: Close: file count is 0 (f_op=iommufd_fops [iommufd]) WARNING: CPU: 48 PID: 2369 at fs/open.c:1507 filp_flush+0x3c/0xf0 Call trace: filp_flush+0x3c/0xf0 (P) filp_flush+0x3c/0xf0 (L) __arm64_sys_close+0x34/0x98 ... imbalanced put on file reference count WARNING: CPU: 48 PID: 2369 at fs/file.c:74 __file_ref_put+0x100/0x138 Call trace: __file_ref_put+0x100/0x138 (P) __file_ref_put+0x100/0x138 (L) __fput_sync+0x4c/0xd0 Drop those two lines to fix the warnings above.

HighCVSS 7.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A Linux kernel error can release the same iommufd fault-related resources twice during failure cleanup. This creates broken reference counts, kernel warnings, and memory leakage. The supplied CVSS rates potential confidentiality, integrity, and availability impact as high, although the sources do not demonstrate a practical compromise.

Executive priority

Treat this as a high-priority kernel update, particularly on shared systems permitting low-privileged local access. The high CVSS score warrants timely remediation, but the absence of documented exploitation and uncertain practical impact do not support describing it as an emergency solely from this evidence.

Technical view

In iommufd_fault_alloc(), fput() invokes the file release operation, which already releases the fault object and iommufd context. The vulnerable error path then releases both again, causing imbalanced file and object reference counts, refcount saturation warnings, and leaked memory. The fixes remove the two redundant releases.

Likely exposure

Exposure requires an affected Linux kernel and access to the relevant iommufd path. The bundle identifies versions 6.11, 6.12.5, and 6.13 as affected, but its version encoding is ambiguous. Confirm exact affected ranges and backports with the system's kernel distributor.

Exploitation context

The CVSS vector describes a local, low-privilege attack requiring no user interaction. The supplied sources provide no evidence of public exploitation or active attacks, and this CVE is not listed as KEV in the bundle. Practical exploitability beyond warnings and leakage is not established.

Researcher notes

The patch is narrowly scoped: remove duplicate fault-object and context releases after fput(). The description demonstrates deterministic reference-count corruption and leakage warnings, but does not establish code execution or another exploitable primitive. Exact affected-version boundaries are unclear in the supplied metadata and require distributor confirmation.

Mitigation direction

  • Install a vendor-supported kernel update incorporating one of the referenced stable fixes.
  • Reboot affected systems into the updated kernel after installation.
  • If updating is delayed, follow distributor guidance; the supplied sources name no workaround.
  • Prioritize systems where low-privileged local users can access affected iommufd functionality.

Validation and detection

  • Record the running kernel version and compare it with distributor-specific affected-version guidance.
  • Confirm the installed kernel contains either referenced fix or an equivalent backport.
  • Inspect kernel logs for refcount saturation, file-count, and imbalanced file-reference warnings.
  • After updating, confirm the running kernel is the remediated build.
  • Exercise legitimate iommufd workloads and verify the documented warnings do not recur.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2024-56624 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
0ADP providers
3Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.8CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.8High
CVSS 3.1 vector shape for CVE-2024-56624Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux07838f7fd529c8a6de44b601d4b7057e6c8d36ed, 07838f7fd529c8a6de44b601d4b7057e6c8d36edunaffected
LinuxLinux6.11, 0, 6.12.5, 6.13affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.