PT-2024-26833 · Linux+4 · Linux Kernel+4

Geert Uytterhoeven + 2 · Published 2024-04-19 · Updated 2024-11-15 · CVE-2024-35996

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.37

Description The issue is related to CPU mitigations in the Linux kernel. A recent commit missed that "cpu mitigations" is completely generic, whereas SPECULATION MITIGATIONS is x86-specific. This led to unnecessary confusion. The mitigation has been re-enabled by default for non-X86 architectures. The change allows x86 to use a single configuration for managing mitigations not strictly related to speculative execution.

Recommendations Update to Linux kernel version 6.6.37 or later to resolve the issue.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2025-08078

CVE-2024-35996

DLA-3842-1

MGASA-2024-0263

MGASA-2024-0266

USN-6949-1

USN-6949-2

USN-6952-1

USN-6952-2

USN-6955-1

Affected Products

Astra Linux

Linuxmint

Linux Kernel

Red Os

Ubuntu

References · 282

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/35xxx/CVE-2024-35996.json · Exploit
• https://ubuntu.com/security/CVE-2024-35984 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-6952-2 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-36912 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-36955 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-38568 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-27394 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-36891 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-36893 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-36030 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-27398 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-38603 · Vendor Advisory
• https://osv.dev/vulnerability/USN-6952-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-38544 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-39482 · Vendor Advisory