CVE-2024-38627 – This CVE describes a double-free vulnerability ... (How to Fix)

Q: What is the severity of CVE-2024-38627?

CVE-2024-38627 has a CVSS score of 7.8 (HIGH). This CVE describes a double-free vulnerability in the Linux kernel's STM (System Trace Module) subsystem. The flaw occurs when registering STM devices, allowing attackers with local access to potentially crash the kernel or execute arbitrary code. All Linux systems using affected kernel versions are vulnerable.

📋 TL;DR

This CVE describes a double-free vulnerability in the Linux kernel's STM (System Trace Module) subsystem. The flaw occurs when registering STM devices, allowing attackers with local access to potentially crash the kernel or execute arbitrary code. All Linux systems using affected kernel versions are vulnerable.

💻 Affected Systems

Products:

Linux kernel

Versions: Specific affected versions not explicitly stated in CVE description; check kernel commit history for exact ranges.

Operating Systems: Linux distributions using vulnerable kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Requires STM subsystem to be enabled/loaded; not all distributions may have this enabled by default.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic leading to system crash or local privilege escalation allowing full system compromise.

🟠

Likely Case

Kernel crash causing denial of service and system instability.

🟢

If Mitigated

Limited impact if proper access controls prevent local attackers from triggering the vulnerable code path.

🌐 Internet-Facing: LOW - Requires local access to exploit.

🏢 Internal Only: MEDIUM - Local attackers or malicious users could exploit this vulnerability.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Requires local access and ability to trigger STM device registration; exploit development would require kernel debugging skills.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Kernel versions containing the fix commits listed in references

Vendor Advisory: https://git.kernel.org/stable/c/370c480410f60b90ba3e96abe73ead21ec827b20

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version from your distribution's repositories. 2. Reboot system to load new kernel.

🔧 Temporary Workarounds

Disable STM subsystem

linux

Prevent loading of STM kernel module to eliminate attack surface

echo 'blacklist stm' >> /etc/modprobe.d/blacklist-stm.conf
rmmod stm

🧯 If You Can't Patch

Restrict local user access to prevent untrusted users from triggering STM operations
Implement strict SELinux/AppArmor policies to limit STM subsystem access

🔍 How to Verify

Check if Vulnerable:

Check kernel version and compare with patched versions in git commits; verify if STM module is loaded with 'lsmod | grep stm'

Check Version:

uname -r

Verify Fix Applied:

Confirm kernel version is updated to include fix commits; verify STM functionality works without crashes

📡 Detection & Monitoring

Log Indicators:

Kernel panic messages
OOM killer activity
System crash/reboot logs

Network Indicators:

None - local vulnerability

SIEM Query:

Search for kernel panic events or system crash reports in system logs

📊 Metadata

CVE ID: CVE-2024-38627

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-415

Published: June 21, 2024

Last Updated: November 4, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-38627, you might also want to check these: