CVE-2024-53136

mediumpriority · track · 19EPSS 0.004 · 36 %ileDEEURUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.42% (36th) EPSS

CVSS 4.7 · medium

Is it mine?

44 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

EPSS · scored 2026-10-27

In the Linux kernel, the following vulnerability has been resolved: mm: revert "mm: shmem: fix data-race in shmem_getattr()" Revert d949d1d14fa2 ("mm: shmem: fix data-race in shmem_getattr()") as suggested by Chuck [1]. It is causing deadlocks when accessing tmpfs over NFS. As Hugh commented, "added just to silence a syzbot sanitizer splat: added where there has never been any practical problem".

cvss

Technical severity, 0–10. One row per scoring source.

7.5

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 4.3–7.5

v3.14.7mediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:Hprimary · NVD / NIST USexploitability 1 · impact 3.6

v3.15.5mediumAV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:Hsecondary · FSTEC (BDU) RU

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · ENISA EU

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondaryexploitability 3.9 · impact 3.6

v3.14.3mediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H/E:Usecondary · CVSS-BT (t0sche)

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-362USprimaryCWE-667US

affected products (44)

Products and version ranges known to be affected.

Dell PowerScale OneFS <4.0.33all versionscert_bundDE
IBM DataPower Gateway <10.6.6.0all versionscert_bundDE
Ubuntu Linuxall versionscert_bundDEcpe:/o:canonical:ubuntu_linux:-
Dell PowerScale OneFS< 4.0.33cert_bundDE
IBM DataPower Gateway< 10.6.6.0cert_bundDE
Linux Linux3d9528484480… → d3f9d88c2c03…enisa_euvdEU
Linux Linux4.19.323 → 4.19.325enisa_euvdEU
Linux Linux5.10.229 → 5.10.231enisa_euvdEU
Linux Linux5.15.171 → 5.15.174enisa_euvdEU
Linux Linux5.4.285 → 5.4.287enisa_euvdEU
Linux Linux6.1.116 → 6.1.119enisa_euvdEU
Linux Linux6.11.7 → 6.11.10enisa_euvdEU
Linux Linux6.6.60 → 6.6.63enisa_euvdEU
Linux Linux7cc30ada8432… → a3c65022d89d…enisa_euvdEU
Linux Linux82cae1e30bd9… → 5874c1150e77…enisa_euvdEU
Linux Linux9fb9703cd43e… → 36b537e8f302…enisa_euvdEU
Linux Linuxbda1a99a0dd6… → 57cc8d253099…enisa_euvdEU
Linux Linuxd949d1d14fa2… → d1aa0c04294e…enisa_euvdEU
Linux Linuxedd1f9050506… → 64e67e869425…enisa_euvdEU
Linux Linuxffd56612566b… → 901dc2ad7c37…enisa_euvdEU

showing 20 of 44

advisories (2)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2024-3608Linux Kernel: Mehrere Schwachstellen ermöglichen Denial of ServiceDeutsch2024-12-04csaf · cert_bundDE
Ein lokaler Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um einen Denial of Service Angriff durchzuführen.
WID-SEC-W-2025-2855IBM DataPower Gateway: Mehrere SchwachstellenDeutsch2025-12-15csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in IBM DataPower Gateway ausnutzen, um beliebigen Programmcode auszuführen, Daten zu manipulieren, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder andere, nicht spezifizierte Angriffe durchzuführen.

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cert_bund NVD CVE.org MITRE

published 2024-12-04modified 2026-08-04

related (4,139)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2025-62215US	—OT critical	4.46% (91st)	KEV	2025-11-11
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an authorized attacker to elevate privileges locally.
CVE-2025-39964US	medium5.5OT critical	1.57% (75th)	KEV	2025-10-13
In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg Issuing two writes to the same af_alg socket is…
CVE-2025-2783US	—OT critical	9.24% (95th)	KEV	2025-03-26
Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 134.0.6998.177 allowed a remote attacker to perform a sandbox escape via a malic…
CVE-2025-22224US	high8.2OT critical	1.56% (75th)	KEV	2025-03-04
VMware ESXi, and Workstation contain a TOCTOU (Time-of-Check Time-of-Use) vulnerability that leads to an out-of-bounds write. A malicious actor with local administrative privileges…
CVE-2023-36884US	—OT critical	99.4% (100th)	KEV	2023-07-11
Windows Search Remote Code Execution Vulnerability

+4134 more

references (22)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan