Security readout for executives and security teams
Plain-English summary
This is a Linux kernel memory-safety flaw in block cgroup cleanup. A local low-privileged user could potentially cause serious confidentiality, integrity, or availability impact. The source says the bug was difficult to trigger in testing, but the CVSS score is high.
Executive priority
Patch during the next high-priority kernel maintenance window, sooner for shared or untrusted workload hosts. No active exploitation is evidenced here, but the potential impact is high.
Technical view
blkcg_unpin_online() could read a block cgroup parent pointer after blkcg_destroy_blkgs() potentially freed the object, causing a use-after-free. The fix reads the parent pointer before destroying the blkcg block groups. The issue is CWE-416 with CVSS 3.1 score 7.8.
Likely exposure
Exposure is limited to Linux systems running affected kernel versions or downstream products that include the vulnerable blk-cgroup code. Risk is most relevant where local users, workloads, or hosted services can execute code on the system.
Exploitation context
The bundle does not show KEV listing or active exploitation. The kernel description says triggering was not easy and required artificial delay injection during testing. Treat exploitability as plausible but not confirmed in the provided sources.
Researcher notes
The strongest evidence is the upstream kernel fix narrative and stable commit references. The provided affected-version data is incomplete in this prompt, so use vendor advisories for exact package and product applicability.
Mitigation direction
- Update to a vendor kernel containing the referenced stable fixes.
- Prioritize multi-user Linux hosts and systems running untrusted workloads.
- Check Debian LTS and Siemens advisories if those environments apply.
- Follow distribution or vendor guidance for exact package versions.
- Plan reboot or live-patching according to normal kernel update process.
Validation and detection
- Inventory Linux kernel versions across affected servers and appliances.
- Map kernels against vendor advisories and referenced stable commits.
- Confirm whether Debian LTS or Siemens-covered products are in scope.
- Verify patched systems are running the updated kernel after maintenance.
- Monitor kernel logs for instability, but do not rely on logs for exposure proof.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-416: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2024-56672 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/83f5a87ee8caa76a917f59912a74d6811f773c67CVE reference, Linux
- https://git.kernel.org/stable/c/8a07350fe070017a887433f4d6909433955be5f1CVE reference, Linux
- https://git.kernel.org/stable/c/64afc6fe24c9896c0153e5a199bcea241ecb0d5cCVE reference, Linux
- https://git.kernel.org/stable/c/5baa28569c924d9a90d036c2aaab79f791fedaf8CVE reference, Linux
- https://git.kernel.org/stable/c/29d1e06560f0f6179062ac638b4064deb637d1adCVE reference, Linux
- https://git.kernel.org/stable/c/86e6ca55b83c575ab0f2e105cf08f98e58d3d7afCVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/03/msg00001.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/03/msg00002.htmlCVE reference, CVE
- https://cert-portal.siemens.com/productcert/html/ssa-265688.htmlCVE reference, siemens-SADP
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use After Free
Use After Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.