PT-2024-4111 · Linux+4 · Linux Kernel+4

Published 2024-04-26 · Updated 2025-09-29 · CVE-2024-36956

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.8

Description The issue is related to a memory leak in the thermal zone diagnostics of the Linux kernel. The function thermal debug tz remove() does not free all allocated memory for thermal zone diagnostics, resulting in unreachable memory after the thermal zone's struct thermal debugfs object is freed. This can lead to a denial of service.

Recommendations To resolve the issue, update to Linux kernel version 6.8 or later. As a temporary workaround, consider disabling the thermal debug tz remove() function until a patch is available.

Exploit

Fix

Memory Leak

Weakness Enumeration

CWE-401

Related Identifiers

ALSA-2025_12746

ALSA-2025_12752

ALSA-2025_12753

ALSA-2025_16880

BDU:2024-04562

CVE-2024-36956

INFSA-2024_9315

RHSA-2024:9315

RHSA-2024_9315

USN-6949-1

USN-6949-2

USN-6952-1

USN-6952-2

USN-6955-1

Affected Products

Astra Linux

Linuxmint

Linux Kernel

Red Hat

Ubuntu

References · 261

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/36xxx/CVE-2024-36956.json · Exploit
• https://ubuntu.com/security/CVE-2024-35984 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-6952-2 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-36912 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-36955 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-38568 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-27394 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-36891 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-36893 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-36030 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-27398 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-38603 · Vendor Advisory
• https://osv.dev/vulnerability/USN-6952-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-38544 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-39482 · Vendor Advisory