What is the CVSS score of CVE-2024-27393?

CVE-2024-27393 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Which versions of Linux Kernel are affected by CVE-2024-27393?

The Xen virtualization infrastructure faces an availability risk from unauthenticated remote attackers exploiting a memory leak in the xen-netfront network driver, which could cause gradual…. A patch is available.

How to fix or mitigate CVE-2024-27393?

Within 24 hours, inventory Xen host and guest kernel versions across your infrastructure to identify instances running v5.9 through current unpatched versions and assess network exposure to untrusted peers. Within 7 days, coordinate with your Xen/Linux vendor to obtain the patched kernel version and develop a rolling update strategy that minimizes VM downtime. Complete patching of all affected Xen guest VMs within 30 days, prioritizing systems facing direct network exposure or running critical workloads.

Linux Kernel CVE-2024-27393

HIGH

Memory Leak (CWE-401)

2024-05-14 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Information Disclosure Linux

7.5

CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Network traffic triggers the leak without authentication; impact is availability only via memory exhaustion; Xen-guest requirement is a deployment precondition, not an attack complexity factor per CVSS conventions.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 04, 2026 - 12:50 vuln.today

v3 (cvss_changed)

Analysis Updated

Aug 04, 2026 - 12:49 vuln.today

v2 (cvss_changed)

Analysis Updated

Aug 04, 2026 - 12:48 vuln.today

v1 (cvss_changed)

Re-analysis Queued

Aug 04, 2026 - 11:23 vuln.today

cvss_changed

Severity Changed

Aug 04, 2026 - 11:23 NVD

MEDIUM HIGH

CVSS changed

Aug 04, 2026 - 11:23 NVD

5.5 (MEDIUM) 7.5 (HIGH)

CVE Published

May 14, 2024 - 15:12 cve.org

MEDIUM 5.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

xen-netfront: Add missing skb_mark_for_recycle

Notice that skb_mark_for_recycle() is introduced later than fixes tag in commit 6a5bcd84e886 ("page_pool: Allow drivers to hint on SKB recycling").

It is believed that fixes tag were missing a call to page_pool_release_page() between v5.9 to v5.14, after which is should have used skb_mark_for_recycle(). Since v6.6 the call page_pool_release_page() were removed (in commit 535b9c61bdef ("net: page_pool: hide page_pool_release_page()") and remaining callers converted (in commit 6bfef2ec0172 ("Merge branch 'net-page_pool-remove-page_pool_release_page'")).

This leak became visible in v6.8 via commit dba1b8a7ab68 ("mm/page_pool: catch page_pool memory leaks").

AnalysisAI

Memory exhaustion in the Linux kernel's xen-netfront paravirtualized network driver allows remote unauthenticated network peers to cause a slow-burn denial of service against Xen guest VMs. The root cause is a missing skb_mark_for_recycle() call that has left page_pool-backed socket buffers unreleased since approximately v5.9; the leak only became observable in v6.8 when explicit page_pool leak detection was added via commit dba1b8a7ab68. No public exploit code exists and the EPSS score of 0.25% (17th percentile) reflects minimal attacker interest at time of analysis.

Technical ContextAI

The xen-netfront driver is the Linux kernel's paravirtualized network frontend, loaded automatically on systems booting as Xen PV or PVH guests (CPE: cpe:2.3:o:linux:linux_kernel). Page pools, introduced in Linux 5.0, are a high-performance per-driver memory allocator that depends on drivers correctly returning network SKBs to avoid heap exhaustion. Two lifecycle APIs govern this: page_pool_release_page() (required from v5.9 to v5.14) and its successor skb_mark_for_recycle() (introduced in commit 6a5bcd84e886, required from v5.14 onward; page_pool_release_page() was hidden and its callers converted in v6.6 via commits 535b9c61bdef and 6bfef2ec0172). xen-netfront never adopted either call when receiving packets, constituting CWE-401 (Missing Release of Memory after Effective Lifetime). The omission went undetected until mm/page_pool leak catching was added in v6.8, surfacing the long-standing accumulation.

RemediationAI

Apply the five upstream stable-tree patches published to git.kernel.org: 037965402a01, 27aa3e4b3088, 4143b9479caa, 7c1250796b6c, and c8b7b2f158d9. Downstream Linux distributions (Red Hat, Ubuntu, Debian, SUSE) should be consulted for backported stable-branch packages; check vendor errata channels for kernel updates that incorporate these commits. Patch status is confirmed available per kernel.org and XSA-457. As a compensating control for environments that cannot patch immediately, blacklisting the xen-netfront kernel module (echo 'blacklist xen-netfront' >> /etc/modprobe.d/blacklist.conf followed by a reboot) eliminates the leak but also removes all network connectivity for Xen PV/PVH guests - this trade-off is impractical in most production scenarios. Where patching is delayed, monitoring Xen guest VMs for abnormal kernel slab or page_pool memory growth (via /proc/meminfo, slabtop, or kernel OOM event logs) provides early detection before a crash occurs.