Security readout for executives and security teams
Plain-English summary
A memory-management flaw in Linux’s Xe graphics driver can leave stale references after memory moves, causing use-after-free. A local low-privileged user may potentially crash the system or affect confidentiality and integrity. The supplied evidence does not establish real-world exploitation.
Executive priority
Treat as a high-priority kernel maintenance issue on shared Linux endpoints or systems using Intel Xe graphics. Accelerate vendor-supported updates where local untrusted access exists. Internet-facing status alone does not increase exploitability because the documented attack vector is local.
Technical view
The drm/xe register-state pool stores entries in an xarray. If krealloc relocates the pool, those entries still reference freed memory, producing a slab use-after-free during xe_reg_sr_apply_mmio. The kernel fix removes the faulty pool implementation. CVSS 3.1 is 7.8: local access, low complexity, low privileges, no user interaction.
Likely exposure
Exposure is limited to Linux systems within the supplied affected version ranges that use or load the Xe DRM driver. The source identifies Linux 6.8 and boundaries involving 6.12.6 and 6.13, but exact distribution exposure requires checking vendor backports and kernel builds.
Exploitation context
CISA KEV status is false, and the supplied sources provide no evidence of active exploitation or a public exploit. The CVSS vector requires local, low-privileged access. Although the scored impact is high across confidentiality, integrity, and availability, practical exploitation conditions are not documented.
Researcher notes
The demonstrated failure is a four-byte read from freed slab memory during module activity. Stale xarray entries arise only if krealloc moves the backing allocation. Sources establish the bug and corrective design change, but do not document a working privilege-escalation path, exploitation reliability, or observed attacks.
Mitigation direction
- Update to a vendor-supported kernel containing the referenced upstream or stable fix.
- Check distribution advisories because kernel vendors may backport fixes without changing the major version.
- Prioritize multi-user systems where untrusted users can access affected graphics functionality.
- If updating is delayed, consult vendor guidance about safely disabling unused Xe driver functionality.
Validation and detection
- Inventory kernel versions and determine whether the Xe DRM driver is present or loaded.
- Compare vendor kernel changelogs against the two referenced stable commits.
- Confirm the installed build includes removal of the faulty register-state pool.
- Review kernel and KASAN logs for xe_reg_sr_apply_mmio use-after-free reports.
- Retest normal graphics operation after applying the vendor kernel update.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-416: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2024-56652 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/b0193a31a0ca5a0f9e60bb4a86537d46b98111b8CVE reference, Linux
- https://git.kernel.org/stable/c/d7b028656c29b22fcde1c6ee1df5b28fbba987b5CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use After Free
Use After Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.