CVE-2024-36288

CriticalCVSS 9.8

Published: 21/06/2024(UTC)Updated: 04/08/2026(UTC)Translated: 05/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.27%

19th percentile - higher than 19% of all known CVEs

Summary

In the Linux kernel's SUNRPC module, gss_free_in_token_pages() has a loop termination condition issue because the in_token->pages[] array is not NULL terminated, leading to wild memory access (KASAN).

Risk Assessment

May lead to information leak or system crash.

Recommendation

Apply the Linux kernel update that includes the fix for this issue.

Original NVD description (English source)

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Fix loop termination condition in gss_free_in_token_pages() The in_token->pages[] array is not NULL terminated. This results in the following KASAN splat: KASAN: maybe wild-memory-access in range [0x04a2013400000008-0x04a201340000000f]