# CVE-2024-23848: Linux Kernel use-after-free in CEC framework

Source: https://junglewise.ai/threats/cve-2024-23848-linux-kernel-use-after-free-in-cec-framework  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-01-23. Updated: 2026-05-12  
License: CC BY 4.0 with a link back

CVE-2024-23848 · Severity: medium · CVSS 5.5 · Published 2024-01-23

A vulnerability exists in the Linux kernel's Consumer Electronics Control (CEC) framework, which manages communication between multimedia devices like TVs and players. A local attacker could exploit this flaw to cause a system crash or potentially gain unauthorized control over the system. This affects various Linux-based systems, including industrial automation components like the Siemens SIMATIC S7-1500.

Technologies: [Linux Kernel](https://junglewise.ai/threats/technologies/kernel), [Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem](https://junglewise.ai/threats/technologies/simatic-s7-1500-tm-mfp-gnu-linux-subsystem). Vendors: [Linux](https://junglewise.ai/threats/vendors/linux), [Siemens](https://junglewise.ai/threats/vendors/siemens).

## Quick answers

**Is CVE-2024-23848 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-23848 being exploited in the wild.

**How severe is CVE-2024-23848?** Medium severity, with a CVSS score of 5.5, published 23 January 2024.

**Which products and versions are affected?** Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem All versions.

**Is there a fix for CVE-2024-23848?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2024-23848 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2024-23848?** Check whether you run Linux Kernel or Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A use-after-free (UAF) vulnerability exists in the cec_queue_msg_fh function within drivers/media/cec/core/cec-adap.c and drivers/media/cec/core/cec-api.c. The flaw is caused by a race condition where one thread holds a lock on a 'struct cec_fh' while another thread frees the same structure without proper synchronization. When the first thread subsequently attempts to access the freed memory (specifically fh->msgs), a KASAN-detected slab-use-after-free occurs. This can be triggered via the cec_ioctl system call. While primarily resulting in a kernel crash (DoS), the presence of function pointers in the affected structure suggests a potential for privilege escalation.

## Affected products

- Linux Linux Kernel up to and including 6.7.1
- Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem All versions

## Timeline

- 2024-01-18: disclosed: Vulnerability details shared on Linux Kernel Mailing List (LKML)
- 2024-01-23: advisory: CVE-2024-23848 published by MITRE/NVD
- 2024-04-09: advisory: Siemens published advisory SSA-265688 confirming impact on SIMATIC S7-1500 TM MFP

## References

- [https://lore.kernel.org/lkml/e9f42704-2f99-4f2c-ade5-f952e5fd53e5%40xs4all.nl/](https://lore.kernel.org/lkml/e9f42704-2f99-4f2c-ade5-f952e5fd53e5%40xs4all.nl/)
- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)

## Related threats

- [Linux IOMMU page table logic error in arm_lpae_split_blk_unmap](https://junglewise.ai/threats/cve-2026-56934-in-arm-lpae-split-blk-unmap-of-drivers-iommu-io-pgtable-arm)
- [Linux kernel null pointer dereference in TCP established lookup](https://junglewise.ai/threats/cve-2026-99288-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel xen-netback race condition in XenBus disconnect](https://junglewise.ai/threats/cve-2026-99286-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel shared-frag flag loss in skb_zerocopy](https://junglewise.ai/threats/cve-2026-99284-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel netfilter conntrack TCP RST timeout handling](https://junglewise.ai/threats/cve-2026-99283-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)