Security readout for executives and security teams
Plain-English summary
A Linux RDMA software driver can retain a reference to a network device after that device is removed. Delayed kernel work may then access freed memory, potentially crashing the system or corrupting kernel memory. The CVSS assessment is 7.8 and requires local, low-privileged access; remote exploitation is not established by the supplied evidence.
Executive priority
Treat this as a high-priority local kernel issue on systems using RXE, especially shared or multi-user hosts. Patch through normal emergency kernel processes after compatibility testing. Systems without RXE are lower priority, but confirm configuration rather than assuming non-exposure.
Technical view
CVE-2024-57795 is a CWE-416 use-after-free in the RXE RDMA driver. An RDMA cache event can remain queued while its directly referenced net_device is unregistered and freed. Later, rxe_query_port calls dev_get_flags through the stale reference. Stable-kernel commits remove the direct link to net_device.
Likely exposure
Exposure is limited to Linux systems using the RXE software RDMA functionality. The bundle lists 4.8, 6.6.120, 6.12.9, and 6.13 as affected, but does not clearly express complete version ranges. Distribution backports may alter exposure, so kernel package versions alone are insufficient.
Exploitation context
The supplied CVSS vector describes a local, low-complexity attack requiring low privileges and no user interaction. Syzkaller triggered the flaw on a 6.12 release candidate. CISA KEV status is false, and the supplied sources provide no evidence of active exploitation or a publicly weaponized exploit.
Researcher notes
The evidence demonstrates a lifecycle race: work is queued, the associated net_device is freed, and delayed RDMA cache processing dereferences it. The observed KASAN trace establishes memory-safety impact, but the bundle does not demonstrate reliable privilege escalation, confidentiality loss, or exploitation outside a test environment. Exact affected-version boundaries remain unclear.
Mitigation direction
- Update to a vendor-supported kernel containing the applicable stable fix commit.
- Confirm distribution backports with the Linux distributor or appliance vendor.
- Prioritize systems where RXE software RDMA is enabled or operationally required.
- If updating is delayed, seek vendor-supported mitigations; none are named in the supplied sources.
Validation and detection
- Inventory Linux kernel releases and identify hosts using RXE software RDMA.
- Map installed vendor kernel builds to the three referenced stable fix commits.
- Review kernel logs for use-after-free reports involving rxe_query_port, dev_get_flags, or ib_cache_event_task.
- After updating, verify the running kernel includes the vendor backport or applicable upstream fix.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-416: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2024-57795 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/32ca3557d968e662957131374a5f81c9c9cdbba8CVE reference, Linux
- https://git.kernel.org/stable/c/9f6f54e6a6863131442b40e14d1792b090c7ce21CVE reference, Linux
- https://git.kernel.org/stable/c/2ac5415022d16d63d912a39a06f32f1f51140261CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use After Free
Use After Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.