CVE-2024-36958

CriticalCVSS 9.8

Published: 30/05/2024(UTC)Updated: 04/08/2026(UTC)Translated: 05/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.24%

15th percentile - higher than 15% of all known CVEs

Summary

In the Linux kernel, in the NFSD server, there is a crasher in nfsd4_encode_fattr4(). The issue is that args.acl is not initialized early, but it is used in an unconditional call to kfree() on the way out of the function, leading to a crash.

Risk Assessment

A crash of the NFS server can lead to unavailability of file services for clients, impacting business continuity. The fix prevents the crash.

Recommendation

Update the Linux kernel to a version with the fix that initializes args.acl early in nfsd4_encode_fattr4().

Original NVD description (English source)

In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix nfsd4_encode_fattr4() crasher Ensure that args.acl is initialized early. It is used in an unconditional call to kfree() on the way out of nfsd4_encode_fattr4().