CVE-2024-36898 (GCVE-0-2024-36898)

Vulnerability from cvelistv5 – Published: 2024-05-30 15:29 – Updated: 2026-08-05 11:31
VLAI
Title
gpiolib: cdev: fix uninitialised kfifo
Summary
In the Linux kernel, the following vulnerability has been resolved: gpiolib: cdev: fix uninitialised kfifo If a line is requested with debounce, and that results in debouncing in software, and the line is subsequently reconfigured to enable edge detection then the allocation of the kfifo to contain edge events is overlooked. This results in events being written to and read from an uninitialised kfifo. Read events are returned to userspace. Initialise the kfifo in the case where the software debounce is already active.
Severity
7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 65cff70464068a823b3f4a28074000febdce0630 , < c87cc32bc48b187067e089b15ab7a6a7eed5767d (git)
Affected: 65cff70464068a823b3f4a28074000febdce0630 , < 1a51e24404d77bb3307c1e39eee0d8e86febb1a5 (git)
Affected: 65cff70464068a823b3f4a28074000febdce0630 , < 883e4bbf06eb5fb7482679e4edb201093e9f55a2 (git)
Affected: 65cff70464068a823b3f4a28074000febdce0630 , < bd7139a70ee8d8ea872b223e043730cf6f5e2b0e (git)
Affected: 65cff70464068a823b3f4a28074000febdce0630 , < ee0166b637a5e376118e9659e5b4148080f1d27e (git)
Create a notification for this product.
Linux Linux Affected: 5.10
Unaffected: 0 , < 5.10 (semver)
Unaffected: 5.15.203 , ≤ 5.15.* (semver)
Unaffected: 6.1.91 , ≤ 6.1.* (semver)
Unaffected: 6.6.31 , ≤ 6.6.* (semver)
Unaffected: 6.8.10 , ≤ 6.8.* (semver)
Unaffected: 6.9 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-36898",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-10T18:49:07.029417Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-10T18:49:15.269Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:43:50.051Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/1a51e24404d77bb3307c1e39eee0d8e86febb1a5"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/883e4bbf06eb5fb7482679e4edb201093e9f55a2"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/bd7139a70ee8d8ea872b223e043730cf6f5e2b0e"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ee0166b637a5e376118e9659e5b4148080f1d27e"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpio/gpiolib-cdev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c87cc32bc48b187067e089b15ab7a6a7eed5767d",
              "status": "affected",
              "version": "65cff70464068a823b3f4a28074000febdce0630",
              "versionType": "git"
            },
            {
              "lessThan": "1a51e24404d77bb3307c1e39eee0d8e86febb1a5",
              "status": "affected",
              "version": "65cff70464068a823b3f4a28074000febdce0630",
              "versionType": "git"
            },
            {
              "lessThan": "883e4bbf06eb5fb7482679e4edb201093e9f55a2",
              "status": "affected",
              "version": "65cff70464068a823b3f4a28074000febdce0630",
              "versionType": "git"
            },
            {
              "lessThan": "bd7139a70ee8d8ea872b223e043730cf6f5e2b0e",
              "status": "affected",
              "version": "65cff70464068a823b3f4a28074000febdce0630",
              "versionType": "git"
            },
            {
              "lessThan": "ee0166b637a5e376118e9659e5b4148080f1d27e",
              "status": "affected",
              "version": "65cff70464068a823b3f4a28074000febdce0630",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpio/gpiolib-cdev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.10"
            },
            {
              "lessThan": "5.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.203",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.91",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.31",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.203",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.91",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.31",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.10",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngpiolib: cdev: fix uninitialised kfifo\n\nIf a line is requested with debounce, and that results in debouncing\nin software, and the line is subsequently reconfigured to enable edge\ndetection then the allocation of the kfifo to contain edge events is\noverlooked.  This results in events being written to and read from an\nuninitialised kfifo.  Read events are returned to userspace.\n\nInitialise the kfifo in the case where the software debounce is\nalready active."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires opening the /dev/gpiochipN character device and issuing GPIO_V2_GET_LINE_IOCTL / GPIO_V2_LINE_SET_CONFIG_IOCTL plus read(), all local syscall interfaces. There is no remote or adjacent-network path into gpiolib-cdev.\nAC:L - The trigger is a deterministic, race-free ioctl sequence, and the attacker can generate the required edges themselves by flipping BIAS_PULL_UP/PULL_DOWN via SET_CONFIG or driving a loopback line. Software debouncing (gpiod_set_debounce returning -ENOTSUPP) and CONFIG_GPIO_CDEV are the default on essentially all GPIO controllers and embedded kernels.\nPR:L - No capability check exists anywhere along gpio_chrdev_open \u2192 gpio_ioctl \u2192 linereq_create \u2192 linereq_set_config \u2192 linereq_read; access is governed solely by file permissions on /dev/gpiochipN, typically root:gpio 0660. An unprivileged local user in the gpio group \u2014 the standard configuration on embedded, industrial, and single-board Linux systems whose applications drive GPIO from userspace \u2014 is sufficient.\nUI:N - The attacker performs every step unaided, including generating the GPIO edges via bias reconfiguration or a driven loopback line. No victim action is required at any point.\nS:U - The uninitialized kfifo, the leaked stack data, and the NULL dereference are all confined to the kernel\u0027s own security authority on the same host. No hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - Every read() returns 48 bytes of uninitialized kernel stack from linereq_read\u0027s own frame directly to userspace, repeatable without limit, and the attacker can groom that stack region with preceding syscalls to steer what is disclosed. This yields kernel pointers, stack canaries, and residual syscall data \u2014 a KASLR/canary bypass and a broad kernel memory disclosure primitive.\nI:N - With esize=0 the kfifo write path copies zero bytes, and data is always NULL whenever mask is 0, so no kernel memory is modified. The bug produces disclosure and a fault, not a write primitive into valid kernel memory.\nA:H - Because the buggy branch commits edflags while leaving the fifo unallocated, an attacker supplying event_buffer_size=1 across two lines reaches kfifo_copy_in() with esize=48, mask=0, data=NULL, causing memcpy() to a NULL destination in workqueue context \u2014 a kernel oops. Any such crash is scored High."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:31:54.352Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c87cc32bc48b187067e089b15ab7a6a7eed5767d"
        },
        {
          "url": "https://git.kernel.org/stable/c/1a51e24404d77bb3307c1e39eee0d8e86febb1a5"
        },
        {
          "url": "https://git.kernel.org/stable/c/883e4bbf06eb5fb7482679e4edb201093e9f55a2"
        },
        {
          "url": "https://git.kernel.org/stable/c/bd7139a70ee8d8ea872b223e043730cf6f5e2b0e"
        },
        {
          "url": "https://git.kernel.org/stable/c/ee0166b637a5e376118e9659e5b4148080f1d27e"
        }
      ],
      "title": "gpiolib: cdev: fix uninitialised kfifo",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-36898",
    "datePublished": "2024-05-30T15:29:02.011Z",
    "dateReserved": "2024-05-30T15:25:07.066Z",
    "dateUpdated": "2026-08-05T11:31:54.352Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-36898",
      "date": "2026-08-05",
      "epss": "0.00234",
      "percentile": "0.14344"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ngpiolib: cdev: fix uninitialised kfifo\\n\\nIf a line is requested with debounce, and that results in debouncing\\nin software, and the line is subsequently reconfigured to enable edge\\ndetection then the allocation of the kfifo to contain edge events is\\noverlooked.  This results in events being written to and read from an\\nuninitialised kfifo.  Read events are returned to userspace.\\n\\nInitialise the kfifo in the case where the software debounce is\\nalready active.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: gpiolib: cdev: corrige kfifo no inicializado Si se solicita una l\\u00ednea con antirrebote, y eso resulta en un antirrebote en el software, y la l\\u00ednea se reconfigura posteriormente para habilitar la detecci\\u00f3n de bordes, entonces se realiza la asignaci\\u00f3n del Se pasa por alto kfifo para contener eventos de borde. Esto da como resultado que los eventos se escriban y lean desde un kfifo no inicializado. Los eventos le\\u00eddos se devuelven al espacio de usuario. Inicialice el kfifo en el caso de que el software antirrebote ya est\\u00e9 activo.\"}]",
      "id": "CVE-2024-36898",
      "lastModified": "2024-11-21T09:22:45.997",
      "published": "2024-05-30T16:15:13.423",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/1a51e24404d77bb3307c1e39eee0d8e86febb1a5\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/883e4bbf06eb5fb7482679e4edb201093e9f55a2\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/bd7139a70ee8d8ea872b223e043730cf6f5e2b0e\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/ee0166b637a5e376118e9659e5b4148080f1d27e\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/1a51e24404d77bb3307c1e39eee0d8e86febb1a5\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/883e4bbf06eb5fb7482679e4edb201093e9f55a2\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/bd7139a70ee8d8ea872b223e043730cf6f5e2b0e\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/ee0166b637a5e376118e9659e5b4148080f1d27e\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "microsoft_vex": {
      "current_release_date": "2026-03-31T15:03:17.000Z",
      "cve": "CVE-2024-36898",
      "id": "msrc_CVE-2024-36898",
      "initial_release_date": "2024-05-02T07:00:00.000Z",
      "product_status:known_affected": "3",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "gpiolib: cdev: fix uninitialised kfifo",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-36898.json",
      "version": "3"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-36898\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-30T16:15:13.423\",\"lastModified\":\"2026-08-04T11:18:28.343\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ngpiolib: cdev: fix uninitialised kfifo\\n\\nIf a line is requested with debounce, and that results in debouncing\\nin software, and the line is subsequently reconfigured to enable edge\\ndetection then the allocation of the kfifo to contain edge events is\\noverlooked.  This results in events being written to and read from an\\nuninitialised kfifo.  Read events are returned to userspace.\\n\\nInitialise the kfifo in the case where the software debounce is\\nalready active.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: gpiolib: cdev: corrige kfifo no inicializado Si se solicita una l\u00ednea con antirrebote, y eso resulta en un antirrebote en el software, y la l\u00ednea se reconfigura posteriormente para habilitar la detecci\u00f3n de bordes, entonces se realiza la asignaci\u00f3n del Se pasa por alto kfifo para contener eventos de borde. Esto da como resultado que los eventos se escriban y lean desde un kfifo no inicializado. Los eventos le\u00eddos se devuelven al espacio de usuario. Inicialice el kfifo en el caso de que el software antirrebote ya est\u00e9 activo.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/gpio/gpiolib-cdev.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"65cff70464068a823b3f4a28074000febdce0630\",\"lessThan\":\"c87cc32bc48b187067e089b15ab7a6a7eed5767d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"65cff70464068a823b3f4a28074000febdce0630\",\"lessThan\":\"1a51e24404d77bb3307c1e39eee0d8e86febb1a5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"65cff70464068a823b3f4a28074000febdce0630\",\"lessThan\":\"883e4bbf06eb5fb7482679e4edb201093e9f55a2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"65cff70464068a823b3f4a28074000febdce0630\",\"lessThan\":\"bd7139a70ee8d8ea872b223e043730cf6f5e2b0e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"65cff70464068a823b3f4a28074000febdce0630\",\"lessThan\":\"ee0166b637a5e376118e9659e5b4148080f1d27e\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/gpio/gpiolib-cdev.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.10\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.10\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.203\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.91\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.31\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.8.10\",\"lessThanOrEqual\":\"6.8.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.9\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.2},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-06-10T18:49:07.029417Z\",\"id\":\"CVE-2024-36898\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-908\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.10\",\"versionEndExcluding\":\"5.15.203\",\"matchCriteriaId\":\"DE3C5881-28A1-4965-B1A6-562A750E12D4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.91\",\"matchCriteriaId\":\"4F8C886C-75AA-469B-A6A9-12BF1A29C0D5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.31\",\"matchCriteriaId\":\"CDDB1F69-36AC-41C1-9192-E7CCEF5FFC00\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.8.10\",\"matchCriteriaId\":\"6A6B920C-8D8F-4130-86B4-AD334F4CF2E3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"22BEDD49-2C6D-402D-9DBF-6646F6ECD10B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"DF73CB2A-DFFD-46FB-9BFE-AA394F27EA37\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"52048DDA-FC5A-4363-95A0-A6357B4D7F8C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"A06B2CCF-3F43-4FA9-8773-C83C3F5764B2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"F850DCEC-E08B-4317-A33B-D2DCF39F601B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"91326417-E981-482E-A5A3-28BC1327521B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc7:*:*:*:*:*:*\",\"matchCriteriaId\":\"DAECDCD8-F556-4606-8D7B-5C6D47A501F2\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1a51e24404d77bb3307c1e39eee0d8e86febb1a5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/883e4bbf06eb5fb7482679e4edb201093e9f55a2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/bd7139a70ee8d8ea872b223e043730cf6f5e2b0e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c87cc32bc48b187067e089b15ab7a6a7eed5767d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ee0166b637a5e376118e9659e5b4148080f1d27e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/1a51e24404d77bb3307c1e39eee0d8e86febb1a5\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/883e4bbf06eb5fb7482679e4edb201093e9f55a2\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/bd7139a70ee8d8ea872b223e043730cf6f5e2b0e\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ee0166b637a5e376118e9659e5b4148080f1d27e\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T22:46:40+00:00",
      "cve": "CVE-2024-36898",
      "id": "CVE-2024-36898",
      "initial_release_date": "2024-05-30T00:00:00+00:00",
      "product_status:known_affected": "150",
      "product_status:known_not_affected": "48",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: gpiolib: cdev: fix uninitialised kfifo",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-36898.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-05T00:57:46Z",
      "cve": "CVE-2024-36898",
      "id": "CVE-2024-36898",
      "initial_release_date": "2024-06-01T02:23:38Z",
      "product_status:known_affected": "419",
      "product_status:known_not_affected": "193",
      "product_status:recommended": "463",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-36898",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-36898.json",
      "version": "119"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/1a51e24404d77bb3307c1e39eee0d8e86febb1a5\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/883e4bbf06eb5fb7482679e4edb201093e9f55a2\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/bd7139a70ee8d8ea872b223e043730cf6f5e2b0e\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/ee0166b637a5e376118e9659e5b4148080f1d27e\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T03:43:50.051Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-36898\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-06-10T18:49:07.029417Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-06-10T18:49:12.126Z\"}}], \"cna\": {\"title\": \"gpiolib: cdev: fix uninitialised kfifo\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.1, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - Exploitation requires opening the /dev/gpiochipN character device and issuing GPIO_V2_GET_LINE_IOCTL / GPIO_V2_LINE_SET_CONFIG_IOCTL plus read(), all local syscall interfaces. There is no remote or adjacent-network path into gpiolib-cdev.\\nAC:L - The trigger is a deterministic, race-free ioctl sequence, and the attacker can generate the required edges themselves by flipping BIAS_PULL_UP/PULL_DOWN via SET_CONFIG or driving a loopback line. Software debouncing (gpiod_set_debounce returning -ENOTSUPP) and CONFIG_GPIO_CDEV are the default on essentially all GPIO controllers and embedded kernels.\\nPR:L - No capability check exists anywhere along gpio_chrdev_open \\u2192 gpio_ioctl \\u2192 linereq_create \\u2192 linereq_set_config \\u2192 linereq_read; access is governed solely by file permissions on /dev/gpiochipN, typically root:gpio 0660. An unprivileged local user in the gpio group \\u2014 the standard configuration on embedded, industrial, and single-board Linux systems whose applications drive GPIO from userspace \\u2014 is sufficient.\\nUI:N - The attacker performs every step unaided, including generating the GPIO edges via bias reconfiguration or a driven loopback line. No victim action is required at any point.\\nS:U - The uninitialized kfifo, the leaked stack data, and the NULL dereference are all confined to the kernel\u0027s own security authority on the same host. No hypervisor, IOMMU, or sandbox boundary is crossed.\\nC:H - Every read() returns 48 bytes of uninitialized kernel stack from linereq_read\u0027s own frame directly to userspace, repeatable without limit, and the attacker can groom that stack region with preceding syscalls to steer what is disclosed. This yields kernel pointers, stack canaries, and residual syscall data \\u2014 a KASLR/canary bypass and a broad kernel memory disclosure primitive.\\nI:N - With esize=0 the kfifo write path copies zero bytes, and data is always NULL whenever mask is 0, so no kernel memory is modified. The bug produces disclosure and a fault, not a write primitive into valid kernel memory.\\nA:H - Because the buggy branch commits edflags while leaving the fifo unallocated, an attacker supplying event_buffer_size=1 across two lines reaches kfifo_copy_in() with esize=48, mask=0, data=NULL, causing memcpy() to a NULL destination in workqueue context \\u2014 a kernel oops. Any such crash is scored High.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"65cff70464068a823b3f4a28074000febdce0630\", \"lessThan\": \"c87cc32bc48b187067e089b15ab7a6a7eed5767d\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"65cff70464068a823b3f4a28074000febdce0630\", \"lessThan\": \"1a51e24404d77bb3307c1e39eee0d8e86febb1a5\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"65cff70464068a823b3f4a28074000febdce0630\", \"lessThan\": \"883e4bbf06eb5fb7482679e4edb201093e9f55a2\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"65cff70464068a823b3f4a28074000febdce0630\", \"lessThan\": \"bd7139a70ee8d8ea872b223e043730cf6f5e2b0e\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"65cff70464068a823b3f4a28074000febdce0630\", \"lessThan\": \"ee0166b637a5e376118e9659e5b4148080f1d27e\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/gpio/gpiolib-cdev.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.10\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.10\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.15.203\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.91\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.31\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8.10\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.8.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/gpio/gpiolib-cdev.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/c87cc32bc48b187067e089b15ab7a6a7eed5767d\"}, {\"url\": \"https://git.kernel.org/stable/c/1a51e24404d77bb3307c1e39eee0d8e86febb1a5\"}, {\"url\": \"https://git.kernel.org/stable/c/883e4bbf06eb5fb7482679e4edb201093e9f55a2\"}, {\"url\": \"https://git.kernel.org/stable/c/bd7139a70ee8d8ea872b223e043730cf6f5e2b0e\"}, {\"url\": \"https://git.kernel.org/stable/c/ee0166b637a5e376118e9659e5b4148080f1d27e\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ngpiolib: cdev: fix uninitialised kfifo\\n\\nIf a line is requested with debounce, and that results in debouncing\\nin software, and the line is subsequently reconfigured to enable edge\\ndetection then the allocation of the kfifo to contain edge events is\\noverlooked.  This results in events being written to and read from an\\nuninitialised kfifo.  Read events are returned to userspace.\\n\\nInitialise the kfifo in the case where the software debounce is\\nalready active.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.203\", \"versionStartIncluding\": \"5.10\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.91\", \"versionStartIncluding\": \"5.10\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.31\", \"versionStartIncluding\": \"5.10\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8.10\", \"versionStartIncluding\": \"5.10\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9\", \"versionStartIncluding\": \"5.10\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:31:54.352Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-36898\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:31:54.352Z\", \"dateReserved\": \"2024-05-30T15:25:07.066Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-30T15:29:02.011Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.