CVE-2024-36020

In the Linux kernel, the following vulnerability has been resolved: i40e: fix vf may be used uninitialized in this function warning To fix the regression introduced by commit 52424f974bc5, which causes servers hang in very hard to reproduce conditions with resets races. Using two sources for the information is the root cause. In this function before the fix bumping v didn't mean bumping vf pointer. But the code used this variables interchangeably, so stale vf could point to different/not intended vf. Remove redundant "v" variable and iterate via single VF pointer across whole function instead to guarantee VF pointer validity.

CVSS 3.1

5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS

0.3% chance of exploitation in the next 30 days; higher than 17% of CVEs (scores of 2026-10-25)

CWE

CWE-908

Published

2024-05-30

Modified

2026-10-15

Record from

the NVD, synced 2026-10-19

Affected

• debian:debian_linux
• linux:linux_kernel

References

• https://git.kernel.org/stable/c/06df7618f591b2dc43c59967e294d7b9fc8675b6
• https://git.kernel.org/stable/c/0dcf573f997732702917af1563aa2493dc772fc0
• https://git.kernel.org/stable/c/3e89846283f3cf7c7a8e28b342576fd7c561d2ba
• https://git.kernel.org/stable/c/951d2748a2a8242853abc3d0c153ce4bf8faad31
• https://git.kernel.org/stable/c/9dcf0fcb80f6aeb01469e3c957f8d4c97365450a

Check your stackJSON