Security readout for executives and security teams
Plain-English summary
A Linux kernel memory-safety flaw can access freed memory during partition migration on IBM PowerPC pSeries systems using Virtual Accelerator Switchboard (VAS). A local, low-privileged user may be able to trigger severe confidentiality, integrity, or availability effects. Exposure is specialized rather than universal, but affected systems merit prompt remediation.
Executive priority
Treat as a high-priority, platform-specific kernel update. Identify exposed pSeries systems promptly and patch them through supported distribution channels. Systems outside PowerPC pSeries VAS workloads are unlikely to match the described path. Escalate immediately if migration crashes or matching memory-safety diagnostics appear.
Technical view
The VAS window retained a virtual-memory-area pointer after munmap removed the mapping. A later pSeries migration could dereference that stale pointer in reconfig_close_windows, producing a slab use-after-free (CWE-416). The fix adds a VMA close callback that clears the stored mapping pointer. CVSS 3.1 is 7.8: local, low complexity, low privileges, no user interaction.
Likely exposure
Likely limited to Linux on IBM PowerPC pSeries where VAS paste-address mappings and partition migration are used. The supplied affected-version data includes 5.18, 6.1.123, 6.6.69, 6.12.8, and 6.13, but its range semantics are incomplete. Confirm exposure by kernel provenance and fix-commit presence.
Exploitation context
The supplied record does not list this CVE in CISA KEV and provides no evidence of active exploitation. The CVSS vector describes local access with low privileges. The demonstrated failure occurred during migration after a VAS mapping was unmapped; practical exploitability beyond the reported KASAN use-after-free is not established here.
Researcher notes
The source demonstrates a stale vm_area_struct pointer: munmap frees the VMA without clearing the VAS window reference, and migration later reads it. Stable commits are provided for multiple kernel lines. The bundle does not establish reliable exploitation, exact distribution package coverage, or universal affected-version boundaries, so commit-level verification is preferable.
Mitigation direction
- Update to a vendor-supported kernel containing the applicable stable fix commit.
- Check Linux distribution advisories for the exact fixed package matching each deployed release.
- Prioritize PowerPC pSeries hosts using VAS and partition migration.
- If patching is delayed, request vendor guidance for supported interim risk controls.
Validation and detection
- Inventory IBM PowerPC pSeries systems and record their running kernel builds.
- Determine whether workloads create VAS paste-address mappings or use the affected acceleration path.
- Verify the applicable stable fix commit is present in each kernel source or vendor package.
- Review kernel and KASAN logs for use-after-free reports involving reconfig_close_windows or vas_migration_handler.
- Test approved kernel updates through the normal migration workflow before production rollout.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-416: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2024-56765 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/8b2282b5084521254a2cd9742a3f4e1d5b77f843CVE reference, Linux
- https://git.kernel.org/stable/c/b7f60ffdfd96f8fc826f1d61a1c6067d828e20b9CVE reference, Linux
- https://git.kernel.org/stable/c/6d9cd27105459f169993a4c5f216499a946dbf34CVE reference, Linux
- https://git.kernel.org/stable/c/05aa156e156ef3168e7ab8a68721945196495c17CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/03/msg00001.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use After Free
Use After Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.