CVE-2024-36031

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

keys: Fix overwrite of key expiration on instantiation

The expiry time of a key is unconditionally overwritten during instantiation, defaulting to turn it permanent. This causes a problem for DNS resolution as the expiration set by user-space is overwritten to TIME64_MAX, disabling further DNS updates. Fix this by restoring the condition that key_set_expiry is only called when the pre-parser sets a specific expiry.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-324

Affected software

VendorProductVersions
LinuxLinux>= 97be1e865e70e5a0ad0a5b5f5dca5031ca0b53ac, < ad2011ea787928b2accb5134f1e423b11fe80a8a; >= 2552b32b0b349df160a509fe49f5f308cb922f2b, < ed79b93f725cd0da39a265dc23d77add1527b9be; >= 791d5409cdb974c31a1bc7a903ea729ddc7d83df, < e4519a016650e952ad9eb27937f8c447d5a4e06d; >= afc360e8a1256acb7579a6f5b6f2c30b85b39301, < 25777f3f4e1f371d16a594925f31e37ce07b6ec7; >= 39299bdd2546688d92ed9db4948f6219ca1b9542, < 939a08bcd4334bad4b201e60bd0ae1f278d71d41; >= 39299bdd2546688d92ed9db4948f6219ca1b9542, < cc219cb8afbc40ec100c0de941047bb29373126a; >= 39299bdd2546688d92ed9db4948f6219ca1b9542, < 9da27fb65a14c18efd4473e2e82b76b53ba60252; >= 5.10.206, < 5.10.217; >= 5.15.146, < 5.15.159; >= 6.1.70, < 6.1.91; >= 6.6.9, < 6.6.31
LinuxLinux6.7
linuxlinux_kernel>= 97be1e865e70, < ad2011ea7879
linuxlinux_kernel>= 2552b32b0b34, < ed79b93f725c
linuxlinux_kernel>= 791d5409cdb9, < e4519a016650
linuxlinux_kernel>= afc360e8a125, < 25777f3f4e1f
linuxlinux_kernel>= 39299bdd2546, < 939a08bcd433
linuxlinux_kernel>= 39299bdd2546, < cc219cb8afbc
linuxlinux_kernel>= 39299bdd2546, < 9da27fb65a14
linuxlinux_kernel—
linuxlinux_kernel—
linuxlinux_kernel6.7
linuxlinux_kernel—
linuxlinux_kernel—
linuxlinux_kernel—
linuxlinux_kernel—
linuxlinux_kernel—

References

Timeline

Published
May 30, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-360327.1In the Linux kernel, the following vulnerability has been resolved: Bluetooth: qca: fix info leak when fetching fw build id Add the missinCVE-2024-360337.1In the Linux kernel, the following vulnerability has been resolved: Bluetooth: qca: fix info leak when fetching board id Add the missing sCVE-2024-360348.8Zohocorp ManageEngine ADAudit Plus versions below 8003 are vulnerable to authenticated SQL Injection in aggregate reports' search option.CVE-2024-360358.8Zohocorp ManageEngine ADAudit Plus versions below 8003 are vulnerable to authenticated SQL Injection in user session recording.CVE-2024-360364.2Zoho ManageEngine ADAudit Plus versions 7260 and below allows unauthorized local agent machine users to access sensitive information and modCVE-2024-360375.5Zoho ManageEngine ADAudit Plus versions 7260 and below allows unauthorized local agent machine users to view the session recordings.CVE-2024-360386.3Zoho ManageEngine ITOM products versions from 128234 to 128248 are affected by the stored cross-site scripting vulnerability in the proxy seCVE-2024-360396.3PyMySQL through 1.1.0 allows SQL injection if used with untrusted JSON input because keys are not escaped by escape_dict.CVE-2024-36048.8The OSM – OpenStreetMap plugin for WordPress is vulnerable to SQL Injection via the 'tagged_filter' attribute of the 'osm_map_v3' shortcode CVE-2024-360417.8KSmserver in KDE Plasma Workspace (aka plasma-workspace) before 5.27.11.1 and 6.x before 6.0.5.1 allows connections via ICE based purely on CVE-2024-360429.8Silverpeas before 6.3.5 allows authentication bypass by omitting the Password field to AuthenticationServlet, often providing an unauthenticCVE-2024-360436.1question_image.ts in SurveyJS Form Library before 1.10.4 allows contentMode=youtube XSS via the imageLink property.
CVE-2024-36031: Critical severity, CVSS 9.8 | Vulnix