Security readout for executives and security teams
Plain-English summary
This Linux kernel issue can let a local, low-privileged user trigger a kernel panic in systems using the Microchip pci1xxxx GPIO interrupt path. The business impact is availability: affected hosts may crash, but the sources do not indicate data theft, privilege escalation, or remote exploitation.
Executive priority
Treat this as a moderate patching item. It is not a known exploited remote issue, but affected systems can suffer local denial of service. Prioritize operationally important Linux hosts, embedded systems, and devices with Microchip pci1xxxx hardware exposure.
Technical view
The flaw is improper IRQ handling while accessing GPIO values in the Microchip pci1xxxx driver. Linux resolved it by replacing generic_handle_irq with handle_nested_irq. CVSS 3.1 is 5.5 with local access, low complexity, low privileges, no user interaction, and high availability impact only.
Likely exposure
Exposure is most likely on Linux systems running affected kernels where the Microchip pci1xxxx driver and GPIO IRQ functionality are present. The bundle lists Linux 6.1-era and later stable versions as affected, with fixes referenced in kernel stable commits and Debian LTS guidance.
Exploitation context
The CVE is not listed as KEV, and the provided sources do not report active exploitation. The CVSS vector requires local access and low privileges, so this is mainly a local denial-of-service concern rather than an internet-facing compromise path.
Researcher notes
Evidence is limited to the CVE record, Linux stable fixes, and Debian LTS notice. No CWE is assigned. The public description names the faulty IRQ handling pattern and the corrective API change, but does not provide exploit details or broader affected hardware guidance.
Mitigation direction
- Apply vendor or distribution kernel updates that include the referenced stable fixes.
- Review Debian LTS guidance if using Debian-provided kernels.
- Prioritize systems using Microchip pci1xxxx hardware or related GPIO IRQ functionality.
- Limit untrusted local shell access where patching is delayed.
- Monitor vendor advisories for exact fixed package versions.
Validation and detection
- Inventory Linux kernel versions across affected fleets.
- Identify systems loading or depending on the Microchip pci1xxxx driver.
- Confirm installed kernels include the referenced stable commits or distro backports.
- Review crash logs for kernel panics during GPIO IRQ handling.
- Track remediation status separately for appliances and embedded systems.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-57916 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/79aef6187e16b2d32307c8ff610e9e04f7f86e1fCVE reference, Linux
- https://git.kernel.org/stable/c/25692750c0259c5b65afec467d97201a485e8a00CVE reference, Linux
- https://git.kernel.org/stable/c/47d3749ec0cb56b7b98917c190a8c10cb54216fdCVE reference, Linux
- https://git.kernel.org/stable/c/194f9f94a5169547d682e9bbcc5ae6d18a564735CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/03/msg00001.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.