Connect your agent
AdvisoriesCriticalCheck your lockfilePluginHow it worksPricing Connect your agent

CVE record · CVE-2024-36912

Drivers: hv: vmbus: Track decrypted status in vmbus_gpadl

CVSS 9.6 CriticalCriticalEPSS 0.0097 · 61st percentile

Critical, because:

  • CVSS score 9.6: 9.0 or more.

How we decide what’s critical

Published by the CVE Program (CNA: Linux) at 30 May 2024, 15:29 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

Affected products, as the CNA wrote them
VendorProductVersions
Linux Linux
  • affected d4dccf353db80e209f262e3973c834e6e48ba9a9 to before 1999644d95194d4a58d3e80ad04ce19220a01a81 git
  • affected d4dccf353db80e209f262e3973c834e6e48ba9a9 to before 8e62341f5c45b27519b7d193bcc32ada416ad9d8 git
  • affected d4dccf353db80e209f262e3973c834e6e48ba9a9 to before bfae56be077ba14311509e70706a13458f87ea99 git
  • affected d4dccf353db80e209f262e3973c834e6e48ba9a9 to before 211f514ebf1ef5de37b1cf6df9d28a56cfd242ca git
Other versions: unaffected
Linux Linux
  • affected 5.16
  • unaffected before 5.16 semver
  • unaffected 6.1.91 to 6.1.*, inclusive semver
  • unaffected 6.6.31 to 6.6.*, inclusive semver
  • unaffected 6.8.10 to 6.8.*, inclusive semver
  • unaffected 6.9 to *, inclusive original_commit_for_fix
Other versions: affected
Identifiers
CVE-2024-36912
CNA
Linux
Weakness (CWE)
CWE-1258
Tags
Published
30 May 2024
Updated
5 Aug 2026

Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

Severity and exploitation

ScoreRatingCVSSVectorSource
9.6 Critical 3.1 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CNA (Linux)Used for this record
8.1 High 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H ADP (CISA-ADP)
  • CISA KEV Not listed.
  • EPSS 0.0097, the 61st percentile, on 5 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

Timeline

This record came from the full history of the CVE Program, published 30 May 2024. New records show when each source confirmed them.

Sources

References from the CNA

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.