{"id":"CVE-2024-36288","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nSUNRPC: Fix loop termination condition in gss_free_in_token_pages()\n\nThe in_token->pages[] array is not NULL terminated","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nSUNRPC: Fix loop termination condition in gss_free_in_token_pages()\n\nThe in_token->pages[] array is not NULL terminated. This results in\nthe following KASAN splat:\n\n  K…","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-835"],"vendor":"linux","product":"linux_kernel","affected":["linux_kernel < 6.9.4","linux_kernel = 6.10.0"],"patched":["linux_kernel 6.9.4"],"published":"2024-06-21","updated":"2026-10-15","sourceUpdated":"2026-10-15T01:18:22.570","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-36288","references":[{"url":"https://git.kernel.org/stable/c/0a1cb0c6102bb4fd310243588d39461da49497ad","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4a77c3dead97339478c7422eb07bf4bf63577008","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4cefcd0af7458bdeff56a9d8dfc6868ce23d128a","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/57ff6c0a175930856213b2aa39f8c845a53e5b1c","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6ed45d20d30005bed94c8c527ce51d5ad8121018","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/af628d43a822b78ad8d4a58d8259f8bf8bc71115","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b4878ea99f2b40ef1925720b1b4ca7f4af1ba785","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/0a1cb0c6102bb4fd310243588d39461da49497ad","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://git.kernel.org/stable/c/4a77c3dead97339478c7422eb07bf4bf63577008","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://git.kernel.org/stable/c/4cefcd0af7458bdeff56a9d8dfc6868ce23d128a","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://git.kernel.org/stable/c/57ff6c0a175930856213b2aa39f8c845a53e5b1c","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://git.kernel.org/stable/c/6ed45d20d30005bed94c8c527ce51d5ad8121018","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://git.kernel.org/stable/c/af628d43a822b78ad8d4a58d8259f8bf8bc71115","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://git.kernel.org/stable/c/b4878ea99f2b40ef1925720b1b4ca7f4af1ba785","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://git.kernel.org/stable/c/f9977e4e0cd98a5f06f2492b4f3547db58deabf5","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-265688.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-613116.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"tags":["nvd","cve.org"],"epss":0.0075,"epssPercentile":0.54743,"ingestedAt":"2026-10-15T03:30:12.713Z","ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2024-06-21T13:05:00.955390Z"},"slug":"CVE-2024-36288","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nSUNRPC: Fix loop termination condition in gss_free_in_token_pages()\n\nThe in_token->pages[] array is not NULL terminated. This results in\nthe following KASAN splat:\n\n  KASAN: maybe wild-memory-access in range [0x04a2013400000008-0x04a201340000000f]\n\n## Affected\n\n- `linux_kernel < 6.9.4`\n- `linux_kernel = 6.10.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `linux_kernel 6.9.4`","depth":"midnight","depthScore":54,"depthScoreParts":{"impact":53.9,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}