What is CVE-2024-53239?

CVE-2024-53239 is a High severity Linux kernel vulnerability with a CVSS score of 7.8 out of 10, classified as a Use After Free flaw (CWE-416), affecting Linux kernel versions from 2.6.39 onward and patched in 4.19.325, 5.4.287, 5.10.231 and others. CVE-2024-53239 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

What is the CVSS score for CVE-2024-53239?

CVE-2024-53239 has a CVSS score of 7.8 out of 10, rated High severity. The vector string is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Is there a patch available for CVE-2024-53239?

Yes, CVE-2024-53239 has been patched. Fixed versions include 4.19.325, 5.4.287, 5.10.231 and others. If you are running Linux kernel 2.6.39 or later up to the fix versions, apply the relevant patch for your kernel branch.

Is CVE-2024-53239 actively exploited?

CVE-2024-53239 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

What is Use After Free (CWE-416)?

The product references memory after it has been freed, which may cause it to crash, use unexpected values, or execute code. See MITRE CWE for full details: https://cwe.mitre.org/data/definitions/416.html

CVE-2024-53239

High

In the Linux kernel, the following vulnerability has been resolved: ALSA: 6fire: Release resources at card release The current 6fire code tries to release the resources right after the call of usb6fire_chip_abort(). But at this moment, the card object might be still in use (as we're calling snd_card_free_when_closed()). For avoid potential UAFs, move the release of resources to the card's private_free instead of the manual call of usb6fire_chip_destroy() at the USB disconnect callback.

Package Linux Kernel

Published 2024-12-27

Last modified 2025-11-03

CVSS version 3.1

Patch available

Yes

CVSS 3.1 score

7.8

out of 10

High

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Vector string

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness type

CWE-416

CVE-2024-53239 is a Use After Free vulnerability

What is Use After Free?

The product references memory after it has been freed, which may cause it to crash, use unexpected values, or execute code. Learn more on MITRE CWE

Affected versions

Linux kernel versions 2.6.39 and later are affected. Fixed in 4.19.325, 5.4.287, 5.10.231, 5.15.174, 6.1.120, 6.6.64, 6.11.11, 6.12.2, 6.13 and their respective stable series.

Affected from

≥ 2.6.39

Fixed in

✓ 4.19.325 4.19.x ✓ 5.4.287 5.4.x ✓ 5.10.231 5.10.x ✓ 5.15.174 5.15.x ✓ 6.1.120 6.1.x ✓ 6.6.64 6.6.x ✓ 6.11.11 6.11.x ✓ 6.12.2 6.12.x ✓ 6.13

References

11 total

Kernel Git
https://git.kernel.org/stable/c/0df7f4b5cc10f5adf98be0845372e9eef7bb5b09

Patch
Kernel Git
https://git.kernel.org/stable/c/273eec23467dfbfbd0e4c10302579ba441fb1e13

Patch
Kernel Git
https://git.kernel.org/stable/c/57860a80f03f9dc69a34a5c37b0941ad032a0a8c

Patch
Kernel Git
https://git.kernel.org/stable/c/74357d0b5cd3ef544752bc9f21cbeee4902fae6c

Patch
Kernel Git
https://git.kernel.org/stable/c/a0810c3d6dd2d29a9b92604d682eacd2902ce947

Patch

Showing 5 of 11 references View all on NVD

Details

CVE ID CVE-2024-53239

Severity High

CVSS score 7.8 / 10

CVSS version 3.1

Published 2024-12-27

Modified 2025-11-03

KEV No

Patch

Yes

Package linux

Frequently asked questions

What is CVE-2024-53239?

CVE-2024-53239 is a High severity Linux kernel vulnerability with a CVSS score of 7.8 out of 10 , classified as an Use After Free flaw (CWE-416) . It affects Linux kernel versions from 2.6.39 onward and has been patched in 4.19.325, 5.4.287, 5.10.231 and others. CVE-2024-53239 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
What is the CVSS score for CVE-2024-53239?

CVE-2024-53239 has a CVSS score of 7.8 out of 10, rated High severity (CVSS 3.1). The vector string is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Is there a patch available for CVE-2024-53239?

Yes. CVE-2024-53239 has been patched. Fixed versions include 4.19.325, 5.4.287, 5.10.231 and others. If you are running Linux kernel 2.6.39 or later up to the fix versions, apply the relevant patch for your kernel branch.
Is CVE-2024-53239 actively exploited?

No. CVE-2024-53239 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.