CVE-2024-36974: linux
Vulnerability summary
CVE-2024-36974 is a high (CVSS 7.8) vulnerability in linux. EPSS estimates a 0.28% chance of exploitation in the next 30 days, higher than 19.6% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 42 · Related 40Timeline
- 18-06-2024PublishedVulnerability first disclosed.
- 15-10-2026Last modifiedVulnerability information updated.
Description
In the Linux kernel, the following vulnerability has been resolved: net/sched: taprio: always validate TCA_TAPRIO_ATTR_PRIOMAP If one TCA_TAPRIO_ATTR_PRIOMAP attribute has been provided, taprio_parse_mqprio_opt() must validate it, or userspace can inject arbitrary data to the kernel, the second time taprio_change() is called. First call (with valid attributes) sets dev->num_tc to a non zero value. Second call (with arbitrary mqprio attributes) returns early from taprio_parse_mqprio_opt() and bad things can happen.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- NVDNIST7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.28%
Chance of exploitation in the next 30 days
Percentile
20%
Versus all other CVEs
30-day change
0.00 pp
From 0.28% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Ubuntu124 products
- linux< 5.4.0-195.215 | < 5.15.0-121.131 | < 6.8.0-44.44
- linux-allwinner-5.19All versions (No fix recorded)
- linux-aws< 5.4.0-1132.142 | < 5.15.0-1069.75 | < 6.8.0-1015.16
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.11All versions (No fix recorded)
Linux2 products
- linux≥ a3d43c0d56f1b94e74963a2fbadfb70126d92213, < c6041e7124464ce7e896ee3f912897ce88a0c4ec | ≥ a3d43c0d56f1b94e74963a2fbadfb70126d92213, < 6db4af09987cc5d5f0136bd46148b0e0460dae5b | ≥ a3d43c0d56f1b94e74963a2fbadfb70126d92213, < d3dde4c217f0c31ab0621912e682b57e677dd923 | ≥ a3d43c0d56f1b94e74963a2fbadfb70126d92213, < 0bf6cc96612bd396048f57d63f1ad454a846e39c | ≥ a3d43c0d56f1b94e74963a2fbadfb70126d92213, < 724050ae4b76e4fae05a923cb54101d792cf4404 | ≥ a3d43c0d56f1b94e74963a2fbadfb70126d92213, < c37a27a35eadb59286c9092c49c241270c802ae2 | ≥ a3d43c0d56f1b94e74963a2fbadfb70126d92213, < f921a58ae20852d188f70842431ce6519c4fdc36 | 5.2
- linux_kernel≥ 5.2, < 5.4.279 | ≥ 5.5, < 5.10.221 | ≥ 5.11, < 5.15.162 | ≥ 5.16, < 6.1.95 | ≥ 6.2, < 6.6.35 | ≥ 6.7, < 6.9.6 | 6.10:rc1 | 6.10:rc2
Debian1 product
- linux< 6.1.94-1 | < 6.9.7-1
3 vendors · 127 products
