9.8

CVE-2024-36476: RDMA/rtrs: Ensure 'ib_sge list' is accessible

Modified
AliasesUBUNTU-CVE-2024-36476DEBIAN-CVE-2024-36476
Published 15-01-2025Last modified 05-08-2026

Vulnerability summary

CVE-2024-36476 is a critical (CVSS 9.8) NULL Pointer Dereference vulnerability in linux. EPSS estimates a 0.65% chance of exploitation in the next 30 days, higher than 50.9% of scored vulnerabilities.

Priority
Prioritisesevere

Severe, CVSS 9.8 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 1% (FIRST, 03-11-2026)

Source freshness unavailable

How is this decided?
CVSS score
9.8/10
010
Critical · v3.1 (CVE.org)
EPSS score
0.65%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 37 · Related 35
DLA-4075-1DLA-4076-1MGASA-2025-0030MGASA-2025-0032SUSE-SU-2025:0289-1SUSE-SU-2025:0428-1

Timeline

  1. 15-01-2025
    PublishedVulnerability first disclosed.
  2. 05-08-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs: Ensure 'ib_sge list' is accessible Move the declaration of the 'ib_sge list' variable outside the 'always_invalidate' block to ensure it remains accessible for use throughout the function. Previously, 'ib_sge list' was declared within the 'always_invalidate' block, limiting its accessibility, then caused a 'BUG: kernel NULL pointer dereference'[1]. ? __die_body.cold+0x19/0x27 ? page_fault_oops+0x15a/0x2d0 ? search_module_extables+0x19/0x60 ? search_bpf_extables+0x5f/0x80 ? exc_page_fault+0x7e/0x180 ? asm_exc_page_fault+0x26/0x30 ? memcpy_orig+0xd5/0x140 rxe_mr_copy+0x1c3/0x200 [rdma_rxe] ? rxe_pool_get_index+0x4b/0x80 [rdma_rxe] copy_data+0xa5/0x230 [rdma_rxe] rxe_requester+0xd9b/0xf70 [rdma_rxe] ? finish_task_switch.isra.0+0x99/0x2e0 rxe_sender+0x13/0x40 [rdma_rxe] do_task+0x68/0x1e0 [rdma_rxe] process_one_work+0x177/0x330 worker_thread+0x252/0x390 ? __pfx_worker_thread+0x10/0x10 This change ensures the variable is available for subsequent operations that require it. [1] https://lore.kernel.org/linux-rdma/6a1f3e8f-deb0-49f9-bc69-a9b03ecfcda7@fujitsu.com/

CVSS metrics

5 scores · 4 sources · 2 versions

EPSS trend

Probability

0.65%

Chance of exploitation in the next 30 days

Percentile

51%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.64% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Ubuntu123 products
  • linux< 5.15.0-135.146 | < 6.8.0-60.63
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-aws< 5.15.0-1080.87 | < 6.8.0-1029.31
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Linux2 products
  • linux≥ 9cb837480424e78ed585376f944088246685aec3, < 7eaa71f56a6f7ab87957213472dc6d4055862722 | ≥ 9cb837480424e78ed585376f944088246685aec3, < 143378075904e78b3b2a810099bcc3b3d82d762f | ≥ 9cb837480424e78ed585376f944088246685aec3, < 32e1e748a85bd52b20b3857d80fd166d22fa455a | ≥ 9cb837480424e78ed585376f944088246685aec3, < b238f61cc394d5fef27b26d7d9aa383ebfddabb0 | ≥ 9cb837480424e78ed585376f944088246685aec3, < 6ffb5c1885195ae5211a12b4acd2d51843ca41b0 | ≥ 9cb837480424e78ed585376f944088246685aec3, < fb514b31395946022f13a08e06a435f53cf9e8b3 | 5.8
  • linux_kernel≥ 5.8, < 5.10.233 | ≥ 5.11, < 5.15.176 | ≥ 5.16, < 6.1.124 | ≥ 6.2, < 6.6.70 | ≥ 6.7, < 6.12.9 | 6.13:rc1 | 6.13:rc2 | 6.13:rc3 | 6.13:rc4 | 6.13:rc5
Debian1 product
  • linux< 6.1.124-1 | < 6.12.9-1

3 vendors · 126 products

References

40 links
Show all 40 references