CVE-2024-36978: Linux Kernel

High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days.

In the Linux kernel, the following vulnerability has been resolved: net: sched: sch_multiq: fix possible OOB write in multiq_tune() q->bands will be assigned to qopt->bands to execute subsequent code logic after kmalloc. So the old q->bands should not be used in kmalloc. Otherwise, an out-of-bounds write will occur.

Affected products

• Linux Linux Kernel: from 5.4, before 5.4.279 (fixed in 5.4.279); from 5.5, before 5.10.221 (fixed in 5.10.221); from 5.11, before 5.15.162 (fixed in 5.15.162); from 5.16, before 6.1.95 (fixed in 6.1.95); from 6.2, before 6.6.35 (fixed in 6.6.35); from 6.7, before 6.9.6 (fixed in 6.9.6); …

Published 2024-06-19. Last modified 2026-08-04.