CVE-2024-36020

{"dataType": "CVE_RECORD", "cveMetadata": {"cveId": "CVE-2024-36020", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-05-17T13:50:33.157Z", "datePublished": "2024-05-30T14:59:44.447Z", "dateUpdated": "2026-10-15T00:42:15.907Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:31:40.320Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ni40e: fix vf may be used uninitialized in this function warning\n\nTo fix the regression introduced by commit 52424f974bc5, which causes\nservers hang in very hard to reproduce conditions with resets races.\nUsing two sources for the information is the root cause.\nIn this function before the fix bumping v didn't mean bumping vf\npointer. But the code used this variables interchangeably, so stale vf\ncould point to different/not intended vf.\n\nRemove redundant \"v\" variable and iterate via single VF pointer across\nwhole function instead to guarantee VF pointer validity."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable code is the i40e SR-IOV PF reset orchestration, reached through local operations \u2014 sysfs `sriov_numvfs`, ethtool/PF reconfiguration, RTNL `ndo_set_vf_*`, and VF-side virtchnl/VFLR events delivered over PCIe. No remotely received network packet is parsed on this path, so the attacker needs local access to the host or to an attached VF/guest.\nAC:L - This is a race, but the attacker drives it: VF resets can be triggered in a tight loop (VFLR, virtchnl RESET_VF, MTU/ethtool on a delegated VF netdev, MDD/overflow storms) while VF add/remove or PF reconfiguration repeatedly re-enters `i40e_reset_all_vfs()`. The vulnerable window is wide \u2014 the in-flight `i40e_reset_vf()` holds `RESETTING` across 150\u2013250 ms of sleeps \u2014 so repeated attempts land reliably.\nPR:L - The VF-reset side of the race requires no host privileges at all \u2014 a guest VM owning an assigned VF, or an unprivileged container holding a delegated iavf netdev with CAP_NET_ADMIN in its own user namespace, can trigger it at will. In SR-IOV cloud hosts the `sriov_numvfs`/PF-reset side is itself driven by tenant-initiated VM/pod lifecycle events, so no real root in the init namespace is needed.\nUI:N - Exploitation needs only the attacker's own reset traffic and concurrent VF/PF reconfiguration; no administrator or other user has to open a file, mount anything, or take any action.\nS:U - The corruption and the crash are confined to the host kernel, which is the same security authority as the vulnerable driver; no IOMMU or hypervisor isolation boundary is bypassed by the bug itself.\nC:H - The defeated `RESETTING` guard allows two threads to release the same VF VSI, and `i40e_vsi_clear()` unconditionally `kfree()`s it even on the mismatch path, yielding a double-free/use-after-free of `i40e_vsi`, its ring arrays and netdev. A freed-and-reallocated VSI that is still dereferenced gives an attacker who sprays the slab a kernel-memory read primitive.\nI:H - The same double-free/UAF lets attacker-controlled heap data occupy the freed `i40e_vsi`, whose fields (ring pointers, q_vector arrays, `pf->vsi[]` slot) are subsequently written and dereferenced, providing a write primitive suitable for control-flow hijack. The mis-gated cleanup also lets HW register programming and resource accounting be applied to the wrong VF.\nA:H - The upstream author states the bug hangs servers: when the stale pointer reports RESETTING, `i40e_cleanup_reset_vf()` is skipped for every VF, leaving all VFs wedged in reset with `VPGEN_VFRTRIG` asserted and no `VFACTIVE` handshake, killing networking for every guest on the adapter. The double-free path additionally produces an immediate kernel oops/panic."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c"], "versions": [{"version": "76ed715836c6994bac29d9638e9314e6e3b08651", "lessThan": "cc9cd02dd9e8b7764ea9effb24f4f1dd73d1b23d", "status": "affected", "versionType": "git"}, {"version": "e88c2a1e28c5475065563d66c07ca879a9afbd07", "lessThan": "9dcf0fcb80f6aeb01469e3c957f8d4c97365450a", "status": "affected", "versionType": "git"}, {"version": "9abae363af5ced6adbf04c14366289540281fb26", "lessThan": "b8e82128b44fa40bf99a50b919488ef361e1683c", "status": "affected", "versionType": "git"}, {"version": "c39de3ae5075ea5f78e097cb5720d4e52d5caed9", "lessThan": "951d2748a2a8242853abc3d0c153ce4bf8faad31", "status": "affected", "versionType": "git"}, {"version": "52424f974bc53c26ba3f00300a00e9de9afcd972", "lessThan": "3e89846283f3cf7c7a8e28b342576fd7c561d2ba", "status": "affected", "versionType": "git"}, {"version": "52424f974bc53c26ba3f00300a00e9de9afcd972", "lessThan": "0dcf573f997732702917af1563aa2493dc772fc0", "status": "affected", "versionType": "git"}, {"version": "52424f974bc53c26ba3f00300a00e9de9afcd972", "lessThan": "06df7618f591b2dc43c59967e294d7b9fc8675b6", "status": "affected", "versionType": "git"}, {"version": "52424f974bc53c26ba3f00300a00e9de9afcd972", "lessThan": "f37c4eac99c258111d414d31b740437e1925b8e8", "status": "affected", "versionType": "git"}, {"version": "02f949747e6fb767b29f7931d4bbf40911684e7a", "status": "affected", "versionType": "git"}, {"version": "4.19.264", "lessThan": "4.19.312", "status": "affected", "versionType": "semver"}, {"version": "5.4.223", "lessThan": "5.4.274", "status": "affected", "versionType": "semver"}, {"version": "5.10.153", "lessThan": "5.10.215", "status": "affected", "versionType": "semver"}, {"version": "5.15.77", "lessThan": "5.15.154", "status": "affected", "versionType": "semver"}, {"version": "6.0.7", "lessThan": "6.1", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c"], "versions": [{"version": "6.1", "status": "affected"}, {"version": "0", "lessThan": "6.1", "status": "unaffected", "versionType": "semver"}, {"version": "4.19.312", "lessThanOrEqual": "4.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.4.274", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.215", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.154", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.85", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.26", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.8.5", "lessThanOrEqual": "6.8.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.9", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19.264", "versionEndExcluding": "4.19.312"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4.223", "versionEndExcluding": "5.4.274"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10.153", "versionEndExcluding": "5.10.215"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15.77", "versionEndExcluding": "5.15.154"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1", "versionEndExcluding": "6.1.85"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1", "versionEndExcluding": "6.6.26"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1", "versionEndExcluding": "6.8.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1", "versionEndExcluding": "6.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0.7"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/cc9cd02dd9e8b7764ea9effb24f4f1dd73d1b23d"}, {"url": "https://git.kernel.org/stable/c/9dcf0fcb80f6aeb01469e3c957f8d4c97365450a"}, {"url": "https://git.kernel.org/stable/c/b8e82128b44fa40bf99a50b919488ef361e1683c"}, {"url": "https://git.kernel.org/stable/c/951d2748a2a8242853abc3d0c153ce4bf8faad31"}, {"url": "https://git.kernel.org/stable/c/3e89846283f3cf7c7a8e28b342576fd7c561d2ba"}, {"url": "https://git.kernel.org/stable/c/0dcf573f997732702917af1563aa2493dc772fc0"}, {"url": "https://git.kernel.org/stable/c/06df7618f591b2dc43c59967e294d7b9fc8675b6"}, {"url": "https://git.kernel.org/stable/c/f37c4eac99c258111d414d31b740437e1925b8e8"}], "title": "i40e: fix vf may be used uninitialized in this function warning", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-36020", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-06-03T16:54:29.774868Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:48:10.052Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:30:12.504Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/cc9cd02dd9e8b7764ea9effb24f4f1dd73d1b23d", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/9dcf0fcb80f6aeb01469e3c957f8d4c97365450a", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/b8e82128b44fa40bf99a50b919488ef361e1683c", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/951d2748a2a8242853abc3d0c153ce4bf8faad31", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/3e89846283f3cf7c7a8e28b342576fd7c561d2ba", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/0dcf573f997732702917af1563aa2493dc772fc0", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/06df7618f591b2dc43c59967e294d7b9fc8675b6", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/f37c4eac99c258111d414d31b740437e1925b8e8", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html", "tags": ["x_transferred"]}]}, {"x_adpType": "supplier", "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-10-15T00:42:15.907Z"}, "affected": [{"vendor": "Siemens", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "versions": [{"status": "affected", "version": "0", "lessThan": "V1.1.1", "versionType": "custom"}], "defaultStatus": "unknown"}], "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"}]}]}, "dataVersion": "5.2"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/cc9cd02dd9e8b7764ea9effb24f4f1dd73d1b23d", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/9dcf0fcb80f6aeb01469e3c957f8d4c97365450a", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/b8e82128b44fa40bf99a50b919488ef361e1683c", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/951d2748a2a8242853abc3d0c153ce4bf8faad31", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/3e89846283f3cf7c7a8e28b342576fd7c561d2ba", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/0dcf573f997732702917af1563aa2493dc772fc0", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/06df7618f591b2dc43c59967e294d7b9fc8675b6", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/f37c4eac99c258111d414d31b740437e1925b8e8", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:30:12.504Z"}}, {"affected": [{"vendor": "Siemens", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "versions": [{"status": "affected", "version": "0", "lessThan": "V1.1.1", "versionType": "custom"}], "defaultStatus": "unknown"}], "x_adpType": "supplier", "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"}], "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-10-15T00:42:15.907Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-36020", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-06-03T16:54:29.774868Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-03T17:16:38.155Z"}}], "cna": {"title": "i40e: fix vf may be used uninitialized in this function warning", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable code is the i40e SR-IOV PF reset orchestration, reached through local operations \u2014 sysfs `sriov_numvfs`, ethtool/PF reconfiguration, RTNL `ndo_set_vf_*`, and VF-side virtchnl/VFLR events delivered over PCIe. No remotely received network packet is parsed on this path, so the attacker needs local access to the host or to an attached VF/guest.\nAC:L - This is a race, but the attacker drives it: VF resets can be triggered in a tight loop (VFLR, virtchnl RESET_VF, MTU/ethtool on a delegated VF netdev, MDD/overflow storms) while VF add/remove or PF reconfiguration repeatedly re-enters `i40e_reset_all_vfs()`. The vulnerable window is wide \u2014 the in-flight `i40e_reset_vf()` holds `RESETTING` across 150\u2013250 ms of sleeps \u2014 so repeated attempts land reliably.\nPR:L - The VF-reset side of the race requires no host privileges at all \u2014 a guest VM owning an assigned VF, or an unprivileged container holding a delegated iavf netdev with CAP_NET_ADMIN in its own user namespace, can trigger it at will. In SR-IOV cloud hosts the `sriov_numvfs`/PF-reset side is itself driven by tenant-initiated VM/pod lifecycle events, so no real root in the init namespace is needed.\nUI:N - Exploitation needs only the attacker's own reset traffic and concurrent VF/PF reconfiguration; no administrator or other user has to open a file, mount anything, or take any action.\nS:U - The corruption and the crash are confined to the host kernel, which is the same security authority as the vulnerable driver; no IOMMU or hypervisor isolation boundary is bypassed by the bug itself.\nC:H - The defeated `RESETTING` guard allows two threads to release the same VF VSI, and `i40e_vsi_clear()` unconditionally `kfree()`s it even on the mismatch path, yielding a double-free/use-after-free of `i40e_vsi`, its ring arrays and netdev. A freed-and-reallocated VSI that is still dereferenced gives an attacker who sprays the slab a kernel-memory read primitive.\nI:H - The same double-free/UAF lets attacker-controlled heap data occupy the freed `i40e_vsi`, whose fields (ring pointers, q_vector arrays, `pf->vsi[]` slot) are subsequently written and dereferenced, providing a write primitive suitable for control-flow hijack. The mis-gated cleanup also lets HW register programming and resource accounting be applied to the wrong VF.\nA:H - The upstream author states the bug hangs servers: when the stale pointer reports RESETTING, `i40e_cleanup_reset_vf()` is skipped for every VF, leaving all VFs wedged in reset with `VPGEN_VFRTRIG` asserted and no `VFACTIVE` handshake, killing networking for every guest on the adapter. The double-free path additionally produces an immediate kernel oops/panic."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "76ed715836c6994bac29d9638e9314e6e3b08651", "lessThan": "cc9cd02dd9e8b7764ea9effb24f4f1dd73d1b23d", "versionType": "git"}, {"status": "affected", "version": "e88c2a1e28c5475065563d66c07ca879a9afbd07", "lessThan": "9dcf0fcb80f6aeb01469e3c957f8d4c97365450a", "versionType": "git"}, {"status": "affected", "version": "9abae363af5ced6adbf04c14366289540281fb26", "lessThan": "b8e82128b44fa40bf99a50b919488ef361e1683c", "versionType": "git"}, {"status": "affected", "version": "c39de3ae5075ea5f78e097cb5720d4e52d5caed9", "lessThan": "951d2748a2a8242853abc3d0c153ce4bf8faad31", "versionType": "git"}, {"status": "affected", "version": "52424f974bc53c26ba3f00300a00e9de9afcd972", "lessThan": "3e89846283f3cf7c7a8e28b342576fd7c561d2ba", "versionType": "git"}, {"status": "affected", "version": "52424f974bc53c26ba3f00300a00e9de9afcd972", "lessThan": "0dcf573f997732702917af1563aa2493dc772fc0", "versionType": "git"}, {"status": "affected", "version": "52424f974bc53c26ba3f00300a00e9de9afcd972", "lessThan": "06df7618f591b2dc43c59967e294d7b9fc8675b6", "versionType": "git"}, {"status": "affected", "version": "52424f974bc53c26ba3f00300a00e9de9afcd972", "lessThan": "f37c4eac99c258111d414d31b740437e1925b8e8", "versionType": "git"}, {"status": "affected", "version": "02f949747e6fb767b29f7931d4bbf40911684e7a", "versionType": "git"}, {"status": "affected", "version": "4.19.264", "lessThan": "4.19.312", "versionType": "semver"}, {"status": "affected", "version": "5.4.223", "lessThan": "5.4.274", "versionType": "semver"}, {"status": "affected", "version": "5.10.153", "lessThan": "5.10.215", "versionType": "semver"}, {"status": "affected", "version": "5.15.77", "lessThan": "5.15.154", "versionType": "semver"}, {"status": "affected", "version": "6.0.7", "lessThan": "6.1", "versionType": "semver"}], "programFiles": ["drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.1"}, {"status": "unaffected", "version": "0", "lessThan": "6.1", "versionType": "semver"}, {"status": "unaffected", "version": "4.19.312", "versionType": "semver", "lessThanOrEqual": "4.19.*"}, {"status": "unaffected", "version": "5.4.274", "versionType": "semver", "lessThanOrEqual": "5.4.*"}, {"status": "unaffected", "version": "5.10.215", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.154", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.85", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.26", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.8.5", "versionType": "semver", "lessThanOrEqual": "6.8.*"}, {"status": "unaffected", "version": "6.9", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/cc9cd02dd9e8b7764ea9effb24f4f1dd73d1b23d"}, {"url": "https://git.kernel.org/stable/c/9dcf0fcb80f6aeb01469e3c957f8d4c97365450a"}, {"url": "https://git.kernel.org/stable/c/b8e82128b44fa40bf99a50b919488ef361e1683c"}, {"url": "https://git.kernel.org/stable/c/951d2748a2a8242853abc3d0c153ce4bf8faad31"}, {"url": "https://git.kernel.org/stable/c/3e89846283f3cf7c7a8e28b342576fd7c561d2ba"}, {"url": "https://git.kernel.org/stable/c/0dcf573f997732702917af1563aa2493dc772fc0"}, {"url": "https://git.kernel.org/stable/c/06df7618f591b2dc43c59967e294d7b9fc8675b6"}, {"url": "https://git.kernel.org/stable/c/f37c4eac99c258111d414d31b740437e1925b8e8"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ni40e: fix vf may be used uninitialized in this function warning\n\nTo fix the regression introduced by commit 52424f974bc5, which causes\nservers hang in very hard to reproduce conditions with resets races.\nUsing two sources for the information is the root cause.\nIn this function before the fix bumping v didn't mean bumping vf\npointer. But the code used this variables interchangeably, so stale vf\ncould point to different/not intended vf.\n\nRemove redundant \"v\" variable and iterate via single VF pointer across\nwhole function instead to guarantee VF pointer validity."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.19.312", "versionStartIncluding": "4.19.264"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.4.274", "versionStartIncluding": "5.4.223"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.215", "versionStartIncluding": "5.10.153"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.154", "versionStartIncluding": "5.15.77"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.85", "versionStartIncluding": "6.1"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.26", "versionStartIncluding": "6.1"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.8.5", "versionStartIncluding": "6.1"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.9", "versionStartIncluding": "6.1"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "6.0.7"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:31:40.320Z"}}}, "cveMetadata": {"cveId": "CVE-2024-36020", "state": "PUBLISHED", "dateUpdated": "2026-10-15T00:42:15.907Z", "dateReserved": "2024-05-17T13:50:33.157Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-05-30T14:59:44.447Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "cc9cd02dd9e8b7764ea9effb24f4f1dd73d1b23d", "status": "affected", "version": "76ed715836c6994bac29d9638e9314e6e3b08651", "versionType": "git"}, {"lessThan": "9dcf0fcb80f6aeb01469e3c957f8d4c97365450a", "status": "affected", "version": "e88c2a1e28c5475065563d66c07ca879a9afbd07", "versionType": "git"}, {"lessThan": "b8e82128b44fa40bf99a50b919488ef361e1683c", "status": "affected", "version": "9abae363af5ced6adbf04c14366289540281fb26", "versionType": "git"}, {"lessThan": "951d2748a2a8242853abc3d0c153ce4bf8faad31", "status": "affected", "version": "c39de3ae5075ea5f78e097cb5720d4e52d5caed9", "versionType": "git"}, {"lessThan": "3e89846283f3cf7c7a8e28b342576fd7c561d2ba", "status": "affected", "version": "52424f974bc53c26ba3f00300a00e9de9afcd972", "versionType": "git"}, {"lessThan": "0dcf573f997732702917af1563aa2493dc772fc0", "status": "affected", "version": "52424f974bc53c26ba3f00300a00e9de9afcd972", "versionType": "git"}, {"lessThan": "06df7618f591b2dc43c59967e294d7b9fc8675b6", "status": "affected", "version": "52424f974bc53c26ba3f00300a00e9de9afcd972", "versionType": "git"}, {"lessThan": "f37c4eac99c258111d414d31b740437e1925b8e8", "status": "affected", "version": "52424f974bc53c26ba3f00300a00e9de9afcd972", "versionType": "git"}, {"status": "affected", "version": "02f949747e6fb767b29f7931d4bbf40911684e7a", "versionType": "git"}, {"lessThan": "4.19.312", "status": "affected", "version": "4.19.264", "versionType": "semver"}, {"lessThan": "5.4.274", "status": "affected", "version": "5.4.223", "versionType": "semver"}, {"lessThan": "5.10.215", "status": "affected", "version": "5.10.153", "versionType": "semver"}, {"lessThan": "5.15.154", "status": "affected", "version": "5.15.77", "versionType": "semver"}, {"lessThan": "6.1", "status": "affected", "version": "6.0.7", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.1"}, {"lessThan": "6.1", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "4.19.*", "status": "unaffected", "version": "4.19.312", "versionType": "semver"}, {"lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.274", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.215", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.154", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.85", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.26", "versionType": "semver"}, {"lessThanOrEqual": "6.8.*", "status": "unaffected", "version": "6.8.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.9", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"affectedData": [{"defaultStatus": "unknown", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "vendor": "Siemens", "versions": [{"lessThan": "V1.1.1", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "95C7CB4F-1C91-4132-86E9-75623C2EC395", "versionEndExcluding": "4.19.312", "versionStartIncluding": "4.19.264", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "4555EF61-21BD-4839-A0F9-B60850B81369", "versionEndExcluding": "5.4.274", "versionStartIncluding": "5.4.223", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "EE0647FB-D6C3-40CC-8EE8-274153DB1627", "versionEndExcluding": "5.10.215", "versionStartIncluding": "5.10.153", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "A4E389F4-D9DA-4699-92C8-1BBE9B39BBC2", "versionEndExcluding": "5.15.154", "versionStartIncluding": "5.15.77", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "F69F5731-F83E-4D6A-A2AD-A526C1482F8D", "versionEndExcluding": "6.1", "versionStartIncluding": "6.0.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C1FB69F5-E844-4396-88FA-F2795D028A6D", "versionEndExcluding": "6.1.85", "versionStartIncluding": "6.1.1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C520696A-A594-4FFC-A32D-12DA535CE911", "versionEndExcluding": "6.6.26", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "DBD6C99E-4250-4DFE-8447-FF2075939D10", "versionEndExcluding": "6.8.5", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.1:-:*:*:*:*:*:*", "matchCriteriaId": "DE093B34-F4CD-4052-8122-730D6537A91A", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc3:*:*:*:*:*:*", "matchCriteriaId": "E2422816-0C14-4B5E-A1E6-A9D776E5C49B", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc4:*:*:*:*:*:*", "matchCriteriaId": "1C6E00FE-5FB9-4D20-A1A1-5A32128F9B76", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc5:*:*:*:*:*:*", "matchCriteriaId": "35B26BE4-43A6-4A36-A7F6-5B3F572D9186", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc6:*:*:*:*:*:*", "matchCriteriaId": "3FFFB0B3-930D-408A-91E2-BAE0C2715D80", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc7:*:*:*:*:*:*", "matchCriteriaId": "8535320E-A0DB-4277-800E-D0CE5BBA59E8", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc8:*:*:*:*:*:*", "matchCriteriaId": "21718AA4-4056-40F2-968E-BDAA465A7872", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*", "matchCriteriaId": "22BEDD49-2C6D-402D-9DBF-6646F6ECD10B", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*", "matchCriteriaId": "DF73CB2A-DFFD-46FB-9BFE-AA394F27EA37", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*", "matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ni40e: fix vf may be used uninitialized in this function warning\n\nTo fix the regression introduced by commit 52424f974bc5, which causes\nservers hang in very hard to reproduce conditions with resets races.\nUsing two sources for the information is the root cause.\nIn this function before the fix bumping v didn't mean bumping vf\npointer. But the code used this variables interchangeably, so stale vf\ncould point to different/not intended vf.\n\nRemove redundant \"v\" variable and iterate via single VF pointer across\nwhole function instead to guarantee VF pointer validity."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: i40e: se puede usar vf sin inicializar en esta funci\u00f3n advertencia Para corregir la regresi\u00f3n introducida por el commit 52424f974bc5, que hace que los servidores se cuelguen con mucha dificultad para reproducir condiciones con restablecimientos de ejecuci\u00f3n. El uso de dos fuentes para la informaci\u00f3n es la causa fundamental. En esta funci\u00f3n, antes de la correcci\u00f3n, tocar v no significaba tocar el puntero vf. Pero el c\u00f3digo usaba estas variables indistintamente, por lo que un vf obsoleto podr\u00eda apuntar a un vf diferente o no intencionado. Elimine la variable \"v\" redundante e itere mediante un \u00fanico puntero VF en toda la funci\u00f3n para garantizar la validez del puntero VF."}], "id": "CVE-2024-36020", "lastModified": "2026-10-15T01:18:21.873", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-36020", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-06-03T16:54:29.774868Z", "version": "2.0.3"}}]}, "published": "2024-05-30T15:15:49.107", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/06df7618f591b2dc43c59967e294d7b9fc8675b6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0dcf573f997732702917af1563aa2493dc772fc0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3e89846283f3cf7c7a8e28b342576fd7c561d2ba"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/951d2748a2a8242853abc3d0c153ce4bf8faad31"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/9dcf0fcb80f6aeb01469e3c957f8d4c97365450a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b8e82128b44fa40bf99a50b919488ef361e1683c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/cc9cd02dd9e8b7764ea9effb24f4f1dd73d1b23d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f37c4eac99c258111d414d31b740437e1925b8e8"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/06df7618f591b2dc43c59967e294d7b9fc8675b6"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0dcf573f997732702917af1563aa2493dc772fc0"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3e89846283f3cf7c7a8e28b342576fd7c561d2ba"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/951d2748a2a8242853abc3d0c153ce4bf8faad31"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/9dcf0fcb80f6aeb01469e3c957f8d4c97365450a"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b8e82128b44fa40bf99a50b919488ef361e1683c"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/cc9cd02dd9e8b7764ea9effb24f4f1dd73d1b23d"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f37c4eac99c258111d414d31b740437e1925b8e8"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"}, {"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-908"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2024:5102", "cpe": "cpe:/a:redhat:enterprise_linux:8::nfv", "package": "kernel-rt-0:4.18.0-553.16.1.rt7.357.el8_10", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2024-08-08T00:00:00Z"}, {"advisory": "RHSA-2024:5101", "cpe": "cpe:/o:redhat:enterprise_linux:8", "package": "kernel-0:4.18.0-553.16.1.el8_10", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2024-08-08T00:00:00Z"}, {"advisory": "RHSA-2024:4902", "cpe": "cpe:/o:redhat:rhel_aus:8.6", "package": "kernel-0:4.18.0-372.113.1.el8_6", "product_name": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support", "release_date": "2024-07-29T00:00:00Z"}, {"advisory": "RHSA-2024:4902", "cpe": "cpe:/o:redhat:rhel_tus:8.6", "package": "kernel-0:4.18.0-372.113.1.el8_6", "product_name": "Red Hat Enterprise Linux 8.6 Telecommunications Update Service", "release_date": "2024-07-29T00:00:00Z"}, {"advisory": "RHSA-2024:4902", "cpe": "cpe:/o:redhat:rhel_e4s:8.6", "package": "kernel-0:4.18.0-372.113.1.el8_6", "product_name": "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions", "release_date": "2024-07-29T00:00:00Z"}, {"advisory": "RHSA-2024:5255", "cpe": "cpe:/o:redhat:rhel_eus:8.8", "package": "kernel-0:4.18.0-477.67.1.el8_8", "product_name": "Red Hat Enterprise Linux 8.8 Extended Update Support", "release_date": "2024-08-13T00:00:00Z"}, {"advisory": "RHSA-2024:5363", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "kernel-0:5.14.0-427.31.1.el9_4", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2024-08-15T00:00:00Z"}, {"advisory": "RHSA-2024:5363", "cpe": "cpe:/o:redhat:enterprise_linux:9", "package": "kernel-0:5.14.0-427.31.1.el9_4", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2024-08-15T00:00:00Z"}, {"advisory": "RHSA-2024:5066", "cpe": "cpe:/a:redhat:rhel_eus:9.2", "package": "kernel-0:5.14.0-284.77.1.el9_2", "product_name": "Red Hat Enterprise Linux 9.2 Extended Update Support", "release_date": "2024-08-07T00:00:00Z"}, {"advisory": "RHSA-2024:5067", "cpe": "cpe:/a:redhat:rhel_eus:9.2::nfv", "package": "kernel-rt-0:5.14.0-284.77.1.rt14.362.el9_2", "product_name": "Red Hat Enterprise Linux 9.2 Extended Update Support", "release_date": "2024-08-07T00:00:00Z"}], "bugzilla": {"description": "kernel: i40e: fix vf may be used uninitialized in this function warning", "id": "2284400", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2284400"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "verified"}, "cwe": "CWE-362", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ni40e: fix vf may be used uninitialized in this function warning\nTo fix the regression introduced by commit 52424f974bc5, which causes\nservers hang in very hard to reproduce conditions with resets races.\nUsing two sources for the information is the root cause.\nIn this function before the fix bumping v didn't mean bumping vf\npointer. But the code used this variables interchangeably, so stale vf\ncould point to different/not intended vf.\nRemove redundant \"v\" variable and iterate via single VF pointer across\nwhole function instead to guarantee VF pointer validity.", "A flaw was found in the Linux kernel\u2019s Ethernet Controller XL710 family driver. This flaw allows a local user to crash the system."], "mitigation": {"lang": "en:us", "value": "To mitigate this issue, prevent the i40e module from being loaded. Please see https://access.redhat.com/solutions/41278 for information on how to prevent it from loading automatically."}, "name": "CVE-2024-36020", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-05-30T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-36020\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-36020"], "threat_severity": "Moderate"}

{}