Security readout for executives and security teams
Plain-English summary
A Linux kernel cleanup race can use a UDP socket after its network namespace has been freed. A local, low-privileged attacker may be able to trigger serious confidentiality, integrity, or availability impact, although the supplied sources show no confirmed exploitation.
Executive priority
Schedule prompt remediation within the normal high-severity kernel patch cycle. Accelerate systems offering local access to less-trusted users or workloads. Emergency action is not supported by the supplied evidence because exploitation is unconfirmed and the vulnerable path is local and feature-specific.
Technical view
TIPC defers UDP bearer socket cleanup to a workqueue. The work decremented wq_count before releasing the socket, allowing network namespace cleanup to proceed prematurely and causing a CWE-416 use-after-free. The stable fix moves the decrement until after socket release.
Likely exposure
Exposure is limited to affected Linux kernels where TIPC UDP bearer teardown and network namespace cleanup can reach the faulty sequence. The bundle identifies affected releases including 5.13, 5.4.287, 5.10.231, 5.15.174, 6.1.120, 6.6.66, 6.12.5, and 6.13. Distribution backports may change exposure.
Exploitation context
CVSS 3.1 scores this 7.8 with local access and low privileges required, without user interaction. The issue was detected by syzkaller and KMSAN without a reproducer. It is not listed as KEV in the supplied bundle, and no source provided confirms active exploitation.
Researcher notes
The reported failure occurs when tipc_exit_net() trusts wq_count after cleanup_bearer() decrements it too early. cleanup_net() can then free namespace state before the deferred worker releases its UDP kernel socket. Evidence includes a KMSAN use-after-free trace, but no reproducer, exploitability demonstration, or observed attacks.
Mitigation direction
- Install a vendor-supported kernel containing the referenced stable fix.
- Reboot affected systems into the corrected kernel after installation.
- Review Linux distribution advisories for package-specific fixed versions and backports.
- Prioritize multi-user or less-trusted local-access systems for remediation.
Validation and detection
- Record the running kernel version on each potentially affected system.
- Compare vendor package revisions against published fixes, accounting for backported patches.
- Confirm whether systems use TIPC UDP bearers and network namespaces.
- Verify the corrected kernel is running after reboot.
- Monitor vendor advisories for revised affected-version information.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-416: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2024-56642 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/4e69457f9dfae67435f3ccf29008768eae860415CVE reference, Linux
- https://git.kernel.org/stable/c/650ee9a22d7a2de8999fac2d45983597a0c22359CVE reference, Linux
- https://git.kernel.org/stable/c/d2a4894f238551eae178904e7f45af87577074fdCVE reference, Linux
- https://git.kernel.org/stable/c/d62d5180c036eeac09f80660edc7a602b369125fCVE reference, Linux
- https://git.kernel.org/stable/c/d00d4470bf8c4282617a3a10e76b20a9c7e4cffaCVE reference, Linux
- https://git.kernel.org/stable/c/e48b211c4c59062cb6dd6c2c37c51a7cc235a464CVE reference, Linux
- https://git.kernel.org/stable/c/6a2fa13312e51a621f652d522d7e2df7066330b6CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/03/msg00001.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/03/msg00002.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use After Free
Use After Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.