CVE-2024-36018

MediumCVSS 5.5/10Last modified Aug 4, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

nouveau/uvmm: fix addr/range calcs for remap operations

dEQP-VK.sparse_resources.image_rebind.2d_array.r64i.128_128_8 was causing a remap operation like the below.

op_remap: prev: 0000003fffed0000 00000000000f0000 00000000a5abd18a 0000000000000000 op_remap: next: op_remap: unmap: 0000003fffed0000 0000000000100000 0 op_map: map: 0000003ffffc0000 0000000000010000 000000005b1ba33c 00000000000e0000

This was resulting in an unmap operation from 0x3fffed0000+0xf0000, 0x100000 which was corrupting the pagetables and oopsing the kernel.

Fixes the prev + unmap range calcs to use start/end and map back to addr/range.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-787

Affected software

VendorProductVersions
LinuxLinux>= b88baab828713ce0b49b185444b2ee83bed373a8, < 692a51bebf4552bdf0a79ccd68d291182a26a569; >= b88baab828713ce0b49b185444b2ee83bed373a8, < 0c16020d2b69a602c8ae6a1dd2aac9a3023249d6; >= b88baab828713ce0b49b185444b2ee83bed373a8, < be141849ec00ef39935bf169c0f194ac70bf85ce
LinuxLinux6.6

References

Timeline

Published
May 30, 2024
Last modified
Aug 4, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-360197.1In the Linux kernel, the following vulnerability has been resolved: regmap: maple: Fix cache corruption in regcache_maple_drop() When keepCVE-2024-36024.3The Pop ups, Exit intent popups, email popups, banners, bars, countdowns and cart savers – Promolayer plugin for WordPress is vulnerable to CVE-2024-360205.5In the Linux kernel, the following vulnerability has been resolved: i40e: fix vf may be used uninitialized in this function warning To fixCVE-2024-360215.5In the Linux kernel, the following vulnerability has been resolved: net: hns3: fix kernel crash when devlink reload during pf initializatioCVE-2024-360235.5In the Linux kernel, the following vulnerability has been resolved: Julia Lawall reported this null pointer dereference, this should fix itCVE-2024-360244.7In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Disable idle reallow as part of command/gpint executioCVE-2024-360255.5In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix off by one in qla_edif_app_getstats() The app_replyCVE-2024-360265.5In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: fixes a random hang in S4 for SMU v13.0.4/11 While doing mCVE-2024-360277.1In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: do not flag ZEROOUT on non-dirty extent buffer Btrfs cleCVE-2024-360284.7In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix DEBUG_LOCKS_WARN_ON(1) when dissolve_free_hugetlb_folioCVE-2024-360295.5In the Linux kernel, the following vulnerability has been resolved: mmc: sdhci-msm: pervent access to suspended controller Generic sdhci cCVE-2024-36035.4The OSM – OpenStreetMap plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'osm_map' shortcode in all versio
CVE-2024-36018: Medium severity, CVSS 5.5 | Vulnix