What’s Vulnerable › Vulnerabilities

CVE-2024-36900: net: hns3: fix kernel crash when devlink reload during initialization

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-05-30 · updated 2026-06-17
• Weakness: CWE-908

Description

In the Linux kernel, the following vulnerability has been resolved: net: hns3: fix kernel crash when devlink reload during initialization The devlink reload process will access the hardware resources, but the register operation is done before the hardware is initialized. So, processing the devlink reload during initialization may lead to kernel crash. This patch fixes this by registering the devlink after hardware initialization.

Affected products

• Linux kernel: from 5.15 before 6.1.91; from 6.2 before 6.6.31; from 6.7 before 6.8.10; 6.9-rc1, 6.9-rc2, 6.9-rc3, 6.9-rc4, 6.9-rc5, 6.9-rc6 (+1) — fixed in 6.1.91, 6.6.31, 6.8.10

How to fix

Upgrade to a fixed version: Linux kernel 6.1.91, 6.6.31, 6.8.10. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/35d92abfbad88cf947c010baf34b075e40566095
• https://git.kernel.org/stable/c/5c623fe0534806b627054da09b6f51b7b2f7b9cd
• https://git.kernel.org/stable/c/72ede790f5a03c3957487400a1b72ebce293a2e7
• https://git.kernel.org/stable/c/c98bc78ce0909ccc92005e2cb6609ec6c7942f69
• https://git.kernel.org/stable/c/35d92abfbad88cf947c010baf34b075e40566095
• https://git.kernel.org/stable/c/5c623fe0534806b627054da09b6f51b7b2f7b9cd
• https://git.kernel.org/stable/c/72ede790f5a03c3957487400a1b72ebce293a2e7
• https://git.kernel.org/stable/c/c98bc78ce0909ccc92005e2cb6609ec6c7942f69

Get alerted when CVE-2024-36900 or the next vulnerability affects your stack