Security readout for executives and security teams
Plain-English summary
A race in Linux BPF socket-map handling can leave a dangling kernel reference when one socket replaces another while the original closes. A low-privileged local actor may be able to trigger memory corruption, potentially affecting confidentiality, integrity, and availability. Remote-only attackers are not indicated.
Executive priority
Treat as a high-priority kernel maintenance issue, especially on shared or multi-tenant systems. It does not warrant the urgency of a confirmed remotely exploited flaw, but the potential kernel memory corruption and high confidentiality, integrity, and availability impact justify prompt patch validation and rollout.
Technical view
The flaw is a race between sockmap element replacement and socket close-time unlinking. __sock_map_delete() could unreference the replacement socket rather than the original, leaving a dangling map entry. The supplied report demonstrates refcount warnings and a KASAN-detected slab use-after-free. Stable kernel commits change deletion logic to avoid unreferencing replaced elements.
Likely exposure
Exposure is limited to affected Linux kernels and requires local low-privileged access under the supplied CVSS vector. Practical exposure also depends on whether the actor can exercise BPF sockmap operations. The bundled version data is ambiguous, so determine status through distribution advisories and package changelogs rather than version-string comparison alone.
Exploitation context
No cited source reports active exploitation, and the CVE is not identified as being in CISA KEV. The available evidence documents a reproducible kernel use-after-free and assigns CVSS 3.1 score 7.8. Real-world exploitability and reliability are not established by this bundle.
Researcher notes
The demonstrated failure occurs during deferred sockmap cleanup after replacement races with close-time link removal. The vulnerable path can unreference the newly stored socket and leave the map slot dangling. The source bundle does not establish a specific exploitation primitive beyond the observed use-after-free, nor does it provide sufficiently clear affected-version ranges for independent boundary claims.
Mitigation direction
- Apply a supported vendor kernel update containing the cited stable fix or its distribution backport.
- Follow distribution guidance to select the correct fixed package for each kernel branch.
- Reboot affected systems into the updated kernel according to normal change-control procedures.
- Prioritize shared, multi-user, and tenant-facing Linux hosts with untrusted local workloads.
Validation and detection
- Inventory installed and currently running kernel versions across Linux systems.
- Confirm vendor advisories or package changelogs explicitly address CVE-2024-56664 or a cited stable fix.
- After updating, verify systems are running the corrected kernel rather than an older installed image.
- Review kernel logs for related KASAN use-after-free reports or refcount warnings.
- Assess which affected hosts permit untrusted local users or workloads to access relevant BPF functionality.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-56664 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/6deb9e85dc9a2ba4414b91c1b5b00b8415910890CVE reference, Linux
- https://git.kernel.org/stable/c/fdb2cd8957ac51f84c9e742ba866087944bb834bCVE reference, Linux
- https://git.kernel.org/stable/c/b79a0d1e9a374d1b376933a354c4fcd01fce0365CVE reference, Linux
- https://git.kernel.org/stable/c/b015f19fedd2e12283a8450dd0aefce49ec57015CVE reference, Linux
- https://git.kernel.org/stable/c/bf2318e288f636a882eea39f7e1015623629f168CVE reference, Linux
- https://git.kernel.org/stable/c/ed1fc5d76b81a4d681211333c026202cad4d5649CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/05/msg00030.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/03/msg00001.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.