PT-2024-27019 · Linux+7 · Linux Kernel+7

Yi Zhang

·

Published

2024-05-23

·

Updated

2026-05-26

·

CVE-2024-36478

CVSS v2.0

7.5

High

VectorAV:N/AC:L/Au:N/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)
Description The issue is related to a null pointer dereference in the Linux kernel when configuring 'power' and 'submit queues' concurrently, which can trigger a kernel panic. This occurs because del gendisk() can run concurrently with blk mq update nr hw queues(). The problem can be fixed by reusing the global mutex to protect nullb device power store() and nullb update nr hw queues() from configfs.
Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

ALSA-2025_12746
ALSA-2025_12752
ALSA-2025_12753
ALSA-2025_16880
ALT-PU-2025-12647
AZL-48948
AZL-48962
BDU:2025-03061
CVE-2024-36478
DLA-4008-1
DSA-5818-1
OESA-2024-1860
OESA-2024-1861
OESA-2024-1863
OPENSUSE-SU-2024_2372-1
OPENSUSE-SU-2024_2394-1
SUSE-SU-2024:2372-1
SUSE-SU-2024:2394-1
SUSE-SU-2024:2571-1
SUSE-SU-2024:2896-1
SUSE-SU-2024:2939-1
SUSE-SU-2024:2973-1
SUSE-SU-2025:20008-1
SUSE-SU-2025:20028-1
USN-6999-1
USN-6999-2
USN-7004-1
USN-7005-1
USN-7005-2
USN-7008-1
USN-7029-1

Affected Products

Alt Linux
Astra Linux
Debian
Linuxmint
Linux Kernel
Red Os
Suse
Ubuntu