Security readout for executives and security teams
Plain-English summary
A Linux kernel flaw can leave stale I/O memory-management records after virtual devices are detached. In affected Intel VT-d and VFIO environments, this may cause memory leakage, use-after-free behavior, or a host kernel crash. Systems passing multiple virtual functions from different physical devices to one user-space process appear most exposed.
Executive priority
Prioritize virtualization hosts using VFIO passthrough, especially multi-device workloads matching the documented topology. A kernel crash could disrupt hosted services. Patch through normal emergency change controls where exposure is confirmed; other Linux systems can follow risk-based maintenance after configuration validation.
Technical view
Cache tags are removed after Address Translation Services are disabled. CACHE_TAG_DEVTLB entries can therefore survive domain release and later reference freed memory. The documented trigger involves multiple VFs from different PFs assigned through vfio-pci to one process. The fix moves cache_tag_unassign_domain() before iommu_disable_pci_caps().
Likely exposure
Exposure is concentrated in affected Linux kernels using Intel VT-d, ATS, and vfio-pci device passthrough. The supplied record lists Linux 6.10, 6.12.6, and 6.13-related affected version data, but its exact range boundaries are unclear. Ordinary hosts without this virtualization configuration are less likely to encounter the documented condition.
Exploitation context
The CVSS vector describes a local, low-privilege path requiring no user interaction. The supplied sources document crashes in a specific VFIO configuration, but provide no evidence of active exploitation; the CVE is not listed as KEV. Practical security impact beyond denial of service is not established by the bundle.
Researcher notes
The source supports CWE-416 and a faulty cleanup ordering involving DEVTLB cache tags. It demonstrates a crash path during VFIO DMA unmapping, not reliable confidentiality or integrity compromise. Exact affected-version boundaries and distribution backport status require vendor confirmation. No public exploitation evidence is included.
Mitigation direction
- Upgrade to a vendor-supported kernel containing the applicable referenced stable fix.
- Confirm the distribution backport with the Linux or operating-system vendor.
- If patching is delayed, review whether the documented multi-PF VFIO topology can be temporarily limited.
- Follow vendor guidance for any branch-specific mitigation or package version.
Validation and detection
- Record kernel versions on hosts using Intel VT-d, ATS, or vfio-pci passthrough.
- Identify processes receiving multiple VFs originating from different physical functions.
- Verify the deployed kernel contains the applicable stable commit or documented vendor backport.
- Review kernel logs for cache_tag_flush_range faults, NULL dereferences, or VFIO unmap crashes.
- Regression-test VFIO device teardown and DMA unmapping after updating.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-416: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2024-56669 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H26LinuxCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
8.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/9a0a72d3ed919ebe6491f527630998be053151d8CVE reference, Linux
- https://git.kernel.org/stable/c/1f2557e08a617a4b5e92a48a1a9a6f86621def18CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use After Free
Use After Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.