CVE-2024-36020

MEDIUM
Published May 30, 2024 Modified May 12, 2026 CWE-908

Description

In the Linux kernel, the following vulnerability has been resolved: i40e: fix vf may be used uninitialized in this function warning To fix the regression introduced by commit 52424f974bc5, which causes servers hang in very hard to reproduce conditions with resets races. Using two sources for the information is the root cause. In this function before the fix bumping v didn't mean bumping vf pointer. But the code used this variables interchangeably, so stale vf could point to different/not intended vf. Remove redundant "v" variable and iterate via single VF pointer across whole function instead to guarantee VF pointer validity.

Is your site exposed to CVE-2024-36020?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

5.5
MEDIUM
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness Type (CWE)

CWE-908 CWE-908

Affected Products

Vendor Product
linux linux_kernel
linux linux_kernel
linux linux_kernel
linux linux_kernel
linux linux_kernel
linux linux_kernel
linux linux_kernel
linux linux_kernel
linux linux_kernel
linux linux_kernel
linux linux_kernel
linux linux_kernel
linux linux_kernel
linux linux_kernel
linux linux_kernel
linux linux_kernel
linux linux_kernel
debian debian_linux

References

Advisories & Patches

https://git.kernel.org/stable/c/06df7618f591b2dc43c59967e294d7b9fc8675b6 https://git.kernel.org/stable/c/0dcf573f997732702917af1563aa2493dc772fc0 https://git.kernel.org/stable/c/3e89846283f3cf7c7a8e28b342576fd7c561d2ba https://git.kernel.org/stable/c/951d2748a2a8242853abc3d0c153ce4bf8faad31 https://git.kernel.org/stable/c/9dcf0fcb80f6aeb01469e3c957f8d4c97365450a https://git.kernel.org/stable/c/b8e82128b44fa40bf99a50b919488ef361e1683c https://git.kernel.org/stable/c/cc9cd02dd9e8b7764ea9effb24f4f1dd73d1b23d https://git.kernel.org/stable/c/f37c4eac99c258111d414d31b740437e1925b8e8 https://git.kernel.org/stable/c/06df7618f591b2dc43c59967e294d7b9fc8675b6 https://git.kernel.org/stable/c/0dcf573f997732702917af1563aa2493dc772fc0 https://git.kernel.org/stable/c/3e89846283f3cf7c7a8e28b342576fd7c561d2ba https://git.kernel.org/stable/c/951d2748a2a8242853abc3d0c153ce4bf8faad31 https://git.kernel.org/stable/c/9dcf0fcb80f6aeb01469e3c957f8d4c97365450a https://git.kernel.org/stable/c/b8e82128b44fa40bf99a50b919488ef361e1683c https://git.kernel.org/stable/c/cc9cd02dd9e8b7764ea9effb24f4f1dd73d1b23d https://git.kernel.org/stable/c/f37c4eac99c258111d414d31b740437e1925b8e8

Frequently Asked Questions

What is CVE-2024-36020? +
In the Linux kernel, the following vulnerability has been resolved: i40e: fix vf may be used uninitialized in this function warning To fix the regression introduced by commit 52424f974bc5, which causes servers hang in very hard to reproduce conditions with resets races. Using two sources for the information is the root cause. In this function before the fix bumping v didn't mean bumping vf pointer. But the code used this variables interchangeably, so stale vf could point to different/not intended vf. Remove redundant "v" variable and iterate via single VF pointer across whole function instead to guarantee VF pointer validity. It has a CVSS v3.1 base score of 5.5 (MEDIUM).
How severe is CVE-2024-36020? +
CVE-2024-36020 has a CVSS v3.1 score of 5.5 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.
What products are affected by CVE-2024-36020? +
CVE-2024-36020 affects products from debian, linux, specifically: debian_linux, linux_kernel. Check the affected products table above for specific version ranges.
How do I check if I'm vulnerable to CVE-2024-36020? +
You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2025-2329

In high traffic environments, a Silicon Labs OpenThread RCP (see impacted versions) fails to clear the SPI transmit buffer and …
CVE-2025-48513

Use of uninitialized resource within the AMD Platform Management Framework (PMF) could allow an attacker to read a uninitialized kernel …
CVE-2026-49425

The compat32 kevent() handler translates a 64-bit kevent struct into a stack- declared 32-bit struct. It did not first zero …
CVE-2026-49424

The Linux waitid() implementation translates a FreeBSD siginfo_t struct into a stack-declared Linux siginfo_t. It did not first zero the …
CVE-2026-85483

Use of uninitialized resource, Return of wrong status code vulnerability in Apache Thrift c_glib bindings. This issue affects Apache Thrift: …
CVE-2026-58084

To retrieve the previous timer value, the kernel calls realtimer_gettime(), which obtains the current time for the timer's clock. For …

Don't wait for an exploit

Scan your website for vulnerabilities like CVE-2024-36020 — free, no signup required.