PT-2024-4107 · Linux+2 · Linux Kernel+2

Olga Kornievskaia + 1 · Published 2024-03-09 · Updated 2026-04-20 · CVE-2024-36907

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.8.0-rc6+

Description The vulnerability is related to the SUNRPC module in the Linux kernel, specifically with the TCP TLS functionality. A missing rpc stat for TCP TLS can cause a kernel NULL pointer dereference when mounting with xprtsec=tls, leading to a kernel oops. The issue arises from a commit that added functionality to specify rpc stats function but missed adding it to the TCP TLS functionality.

Recommendations To resolve the issue, update the Linux kernel to a version that includes the fix for the SUNRPC vulnerability, which adds the missing rpc stat for TCP TLS. Ensure that the updated kernel version is compatible with your system and configuration.

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

CWE-431

Related Identifiers

BDU:2024-04558

CVE-2024-36907

ECHO-3EFE-8876-E479

SUSE-SU-2024:3194-1

SUSE-SU-2024:3195-1

SUSE-SU-2024:3383-1

SUSE-SU-2025:20044-1

SUSE-SU-2025:20047-1

Affected Products

Debian

Linux Kernel

Suse

References · 914

• https://git.kernel.org/stable/c/024f7744bd09cb2a47a0a96b9c8ad08109de99cc · Patch
• https://git.kernel.org/stable/c/8e088a20dbe33919695a8082c0b32deb62d23b4a · Patch
• https://osv.dev/vulnerability/ROOT-OS-UBUNTU-2204-CVE-2024-36907 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-36907 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2025:20047-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-04558 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2025:20044-1 · Vendor Advisory
• https://git.kernel.org/stable/c/9b332c72299f2ac284ab3d7c0301969b933e4ca1 · Patch
• https://cve.org/CVERecord?id=CVE-2024-36907 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2024-36907 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2024:3194-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-36907 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se18-bulletin-2024-0905SE18MD · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2024:3383-1 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2024-12682.html · Vendor Advisory