5.5

CVE-2024-53241: x86/xen: don't do PV iret hypercall through hypercall page

Modified
AliasesSUSE-SU-2025:0142-1UBUNTU-CVE-2024-53241DEBIAN-CVE-2024-53241
Published 24-12-2024Last modified 11-05-2026

Vulnerability summary

CVE-2024-53241 is a medium (CVSS 5.5) vulnerability in linux. EPSS estimates a 0.31% chance of exploitation in the next 30 days, higher than 23.9% of scored vulnerabilities.

Priority
Routine

Not severe (CVSS 5.5, local access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
5.5/10
010
Medium · v3.1 (NVD)
EPSS score
0.31%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 25 · Related 16
DLA-4075-1DLA-4076-1MGASA-2025-0030MGASA-2025-0032MGASA-2025-0270RHSA-2025:20095

Timeline

  1. 24-12-2024
    PublishedVulnerability first disclosed.
  2. 11-05-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: x86/xen: don't do PV iret hypercall through hypercall page Instead of jumping to the Xen hypercall page for doing the iret hypercall, directly code the required sequence in xen-asm.S. This is done in preparation of no longer using hypercall page at all, as it has shown to cause problems with speculation mitigations. This is part of XSA-466 / CVE-2024-53241.

CVSS metrics

4 scores · 3 sources · 2 versions

EPSS trend

Probability

0.31%

Chance of exploitation in the next 30 days

Percentile

24%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.31% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Version check

Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.

Ubuntu170 products
  • linuxAll versions (No fix recorded) | < 5.15.0-135.146 | < 6.8.0-60.63
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded) | < 5.15.0-1080.87 | < 6.8.0-1029.31
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Linux2 products
  • linux≥ cdacc1278b12d929f9a053c245ff3d16eb7af9f8, < 05df6e6cd9a76b778aee33c3c18c9f3b3566d4a5 | ≥ cdacc1278b12d929f9a053c245ff3d16eb7af9f8, < c7b4cfa6213a44fa48714186dfdf125072d036e3 | ≥ cdacc1278b12d929f9a053c245ff3d16eb7af9f8, < fa719857f613fed94a79da055b13ca51214c694f | ≥ cdacc1278b12d929f9a053c245ff3d16eb7af9f8, < 82c211ead1ec440dbf81727e17b03b5e3c44b93d | ≥ cdacc1278b12d929f9a053c245ff3d16eb7af9f8, < f7c3fdad0a474062d566aae3289d490d7e702d30 | ≥ cdacc1278b12d929f9a053c245ff3d16eb7af9f8, < a2796dff62d6c6bfc5fbebdf2bee0d5ac0438906 | 2.6.27
  • linux_kernel< 5.10.232 | ≥ 5.11, < 5.15.175 | ≥ 5.16, < 6.1.121 | ≥ 6.2, < 6.6.67 | ≥ 6.7, < 6.12.6 | 6.13:rc1 | 6.13:rc2 | 6.13:rc3
Suse2 products
  • xen&distro=SUSE Linux Enterprise Module for Basesystem 15 SP6< 4.18.4_02-150600.3.15.2
  • xen&distro=SUSE Linux Enterprise Module for Server Applications 15 SP6< 4.18.4_02-150600.3.15.2
Debian1 product
  • linux< 6.1.123-1 | < 6.12.6-1
Opensuse1 product
  • xen&distro=openSUSE Leap 15.6< 4.18.4_02-150600.3.15.2

5 vendors · 176 products

References

21 links
Show all 21 references