CVE-2024-36911
A critical flaw in the Linux kernel’s hv_netvsc driver could let an untrusted host cause memory that should remain encrypted to be freed and shared, potentially exposing sensitive data. The issue occurs when set_memory_decrypted() fails and the driver does not check the decrypted flag before freeing memory. The kernel has been patched to prevent this.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux kernel, including version 6.9 and earlier releases that contain the hv_netvsc driver, especially systems running CoCo virtual machines.
Real-world impact
An attacker could trigger the kernel to free decrypted memory that is still shared, leading to the exposure of confidential information or system instability.
Why this severity
The CVSS score of 9.8 reflects that the vulnerability can be exploited remotely without authentication or user interaction, and it can compromise confidentiality, integrity, and availability of the affected system.
What to do about it
- 01Upgrade the Linux kernel to version 6.9 or later.
NVD description
Timeline
- May 30, 2024 · May 30, 2024PublishedDisclosed and added to the National Vulnerability Database.
- Aug 4, 2026 · 2d agoAdvisory updatedThe NVD record was last revised.
- Aug 5, 2026 · 1d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.