NFSD: Fix nfsd4_encode_fattr4() crasher

Summary

CVE	CVE-2024-36958
State	PUBLISHED
Assigner	Linux
Source Priority	CVE Program / NVD first with legacy fallback
Published	2024-05-30 16:15:18 UTC
Updated	2026-08-04 11:18:34 UTC
Description	In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix nfsd4_encode_fattr4() crasher Ensure that args.acl is initialized early. It is used in an unconditional call to kfree() on the way out of nfsd4_encode_fattr4().

Primary CVSS: v3.1 5.5 MEDIUM from [email protected]

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Problem Types: NVD-CWE-noinfo

Version	Source	Type	Score	Severity	Vector
3.1	[email protected]	Primary	5.5	MEDIUM	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H`
3.1	416baaa9-dc9f-4396-8d5f-8c081fb06d67	Secondary	9.8	CRITICAL	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`
3.1	CNA	DECLARED	9.8	CRITICAL	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Type	Vendor	Product	Version	Update	Edition	Language
Operating System	Linux	Linux Kernel	All	All	All	All
Operating System	Linux	Linux Kernel	6.9	rc1	All	All
Operating System	Linux	Linux Kernel	6.9	rc2	All	All
Operating System	Linux	Linux Kernel	6.9	rc3	All	All
Operating System	Linux	Linux Kernel	6.9	rc4	All	All
Operating System	Linux	Linux Kernel	6.9	rc5	All	All
Operating System	Linux	Linux Kernel	6.9	rc6	All	All
Application	Netapp	Converged Systems Advisor Agent	-	All	All	All
Hardware	Netapp	H300s	-	All	All	All
Operating System	Netapp	H300s Firmware	-	All	All	All
Hardware	Netapp	H410c	-	All	All	All
Operating System	Netapp	H410c Firmware	-	All	All	All
Hardware	Netapp	H410s	-	All	All	All
Operating System	Netapp	H410s Firmware	-	All	All	All
Hardware	Netapp	H500s	-	All	All	All
Operating System	Netapp	H500s Firmware	-	All	All	All
Hardware	Netapp	H700s	-	All	All	All
Operating System	Netapp	H700s Firmware	-	All	All	All
Operating System	Netapp	Hci Compute Node	-	All	All	All
Application	Netapp	Solidfire Hci Management Node	-	All	All	All
Application	Netapp	Solidfire Hci Storage Node	-	All	All	All

Source	Vendor	Product	Version	Platforms
CNA	Linux	Linux	affected 83ab8678ad0c6f27594c716cafe59c8bbd5e49ef 6a7b07689af6e4e023404bf69b1230f43b2a15bc git	Not specified
CNA	Linux	Linux	affected 83ab8678ad0c6f27594c716cafe59c8bbd5e49ef 18180a4550d08be4eb0387fe83f02f703f92d4e7 git	Not specified
CNA	Linux	Linux	affected 6.7	Not specified
CNA	Linux	Linux	unaffected 6.7 semver	Not specified
CNA	Linux	Linux	unaffected 6.8.10 6.8.* semver	Not specified
CNA	Linux	Linux	unaffected 6.9 * original_commit_for_fix	Not specified

Reference	Source	Link	Tags
security.netapp.com/advisory/ntap-20250404-0007	af854a3a-2127-422b-91ae-364da2661108	security.netapp.com	Third Party Advisory
git.kernel.org/stable/c/18180a4550d08be4eb0387fe83f02f703f92d4e7	af854a3a-2127-422b-91ae-364da2661108	git.kernel.org	Patch
git.kernel.org/stable/c/6a7b07689af6e4e023404bf69b1230f43b2a15bc	af854a3a-2127-422b-91ae-364da2661108	git.kernel.org	Patch
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

There are currently no legacy QID mappings associated with this CVE.