Security readout for executives and security teams
Plain-English summary
Linux's CAN J1939 networking code mishandles a message-buffer reference, allowing its reference count to fall below the expected value. The supplied record rates potential confidentiality, integrity, and availability impact as critical, but does not document demonstrated exploitation or specific real-world consequences.
Executive priority
Treat this as critical for systems actively using reachable J1939 communications. For systems without that functionality, prioritize rapid exposure verification rather than assuming an internet-wide emergency. Establish vendor patch status immediately and update affected systems during the earliest safe maintenance window.
Technical view
j1939_session_new() failed to acquire the extra skb reference that j1939_session_skb_queue() takes for newly queued buffers. Subsequent reference releases could therefore underflow the skb reference count. The upstream correction adds equivalent reference handling for the initial skb, with separate commits supplied for stable kernel branches.
Likely exposure
The bundle marks Linux 5.4 and several branch versions through 6.13 as affected, but does not provide unambiguous fixed ranges. Exposure is most plausible where CAN J1939 functionality is present and reachable. Distribution kernels may contain backported fixes, so kernel version alone is insufficient.
Exploitation context
The supplied CVSS 9.8 vector assumes network access, low complexity, no privileges, and no user interaction. However, the bundle provides no exploit demonstration or evidence of active exploitation, and KEV is false. Network-rated severity should not be interpreted automatically as internet reachability.
Researcher notes
The evidence supports missing skb reference acquisition in j1939_session_new(), corrected to match queue handling. Multiple branch-specific stable commits are supplied, but no CWE, reproducer, exploitability proof, or precise affected-range notation. Confirm introduction and fix boundaries through distribution advisories and commit ancestry.
Mitigation direction
- Install vendor kernel updates incorporating the applicable upstream stable fix.
- Consult the distribution advisory to identify its fixed package or backported correction.
- If updating is delayed, request vendor-approved interim guidance; none is specified in the bundle.
- Prioritize systems using J1939 on untrusted or shared CAN networks.
Validation and detection
- Inventory running kernels and distribution packages on systems using CAN J1939.
- Determine whether CAN J1939 is enabled and reachable from untrusted nodes.
- Verify vendor advisories or changelogs reference this CVE or an applicable stable commit.
- After updating, reboot and confirm the running kernel is the intended fixed package.
- Perform normal CAN J1939 regression testing without attempting untrusted triggering in production.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-56645 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9LinuxVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/224e606a8d8e8c7db94036272c47a37455667313CVE reference, Linux
- https://git.kernel.org/stable/c/b3282c2bebeeb82ceec492ee4972f51ee7a4a132CVE reference, Linux
- https://git.kernel.org/stable/c/4199dd78a59896e091d3a7a05a77451aa7fd724dCVE reference, Linux
- https://git.kernel.org/stable/c/f117cba69cbbd496babb3defcdf440df4fd6fe14CVE reference, Linux
- https://git.kernel.org/stable/c/426d94815e12b6bdb9a75af294fbbafb9301601dCVE reference, Linux
- https://git.kernel.org/stable/c/68fceb143b635cdc59fed3896d5910aff38f345eCVE reference, Linux
- https://git.kernel.org/stable/c/a8c695005bfe6569acd73d777ca298ddddd66105CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/03/msg00001.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/03/msg00002.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.