CVE-2024-36019
highpriority · track · 28EPSS 0.002 · 15 %ileDEEURUUSEPSS · scored 2026-10-27
In the Linux kernel, the following vulnerability has been resolved: regmap: maple: Fix cache corruption in regcache_maple_drop() When keeping the upper end of a cache block entry, the entry[] array must be indexed by the offset from the base register of the block, i.e. max - mas.index. The code was indexing entry[] by only the register address, leading to an out-of-bounds access that copied some part of the kernel memory over the cache contents. This bug was not detected by the regmap KUnit test because it only tests with a block of registers starting at 0, so mas.index == 0.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.5–7.8
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (50)
Products and version ranges known to be affected.
- IBM Business Automation Workflow 24.0.0all versionscert_bundDEcpe:/a:ibm:business_automation_workflow:24.0.0
- NetApp ActiveIQ Unified Manager for VMware vSphereall versionscert_bundDEcpe:/a:netapp:active_iq_unified_manager:for_vmware_vsphere
advisories (2)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2024-1259Linux Kernel: Mehrere Schwachstellen ermöglichen Denial of Service und unspezifischen AngriffDeutsch2024-05-30csaf · cert_bundDE
Ein lokaler Angreifer kann mehrere Schwachstellen im Linux-Kernel ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen oder einen unspezifischen Angriff durchzuführen.
- WID-SEC-W-2025-1293IBM DataPower Gateway: Mehrere SchwachstellenDeutsch2025-06-10csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM DataPower Gateway ausnutzen, um seine Privilegien zu erhöhen, Informationen auszuspähen, einen Denial-of-Service auszulösen oder weitere unspezifizierte Auswirkungen zu erzielen.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (11)
External citations — patches, advisories, analysis.
- https://cxsecurity.com/cveshow/CVE-2024-36019/cnnvd
- https://git.kernel.org/stable/c/00bb549d7d63a21532e76e4a334d7807a54d9f31cnnvd
- https://git.kernel.org/stable/c/3af6c5ac72dc5b721058132a0a1d7779e443175ecnnvd
- https://git.kernel.org/stable/c/51c4440b9d3fd7c8234e6de9170a487c03506e53cnnvd
- https://vigilance.fr/vulnerability/Linux-kernel-multiple-vulnerabilities-dated-31-05-2024-44426cnnvd
- https://git.kernel.org/stable/c/00bb549d7d63a21532e76e4a334d7807a54d9f31enisa_euvd
- https://git.kernel.org/stable/c/3af6c5ac72dc5b721058132a0a1d7779e443175eenisa_euvd
- https://git.kernel.org/stable/c/51c4440b9d3fd7c8234e6de9170a487c03506e53enisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan