CVE-2024-36019 (GCVE-0-2024-36019)

Vulnerability from cvelistv5 – Published: 2024-05-30 14:59 – Updated: 2026-08-05 11:31
VLAI
Title
regmap: maple: Fix cache corruption in regcache_maple_drop()
Summary
In the Linux kernel, the following vulnerability has been resolved: regmap: maple: Fix cache corruption in regcache_maple_drop() When keeping the upper end of a cache block entry, the entry[] array must be indexed by the offset from the base register of the block, i.e. max - mas.index. The code was indexing entry[] by only the register address, leading to an out-of-bounds access that copied some part of the kernel memory over the cache contents. This bug was not detected by the regmap KUnit test because it only tests with a block of registers starting at 0, so mas.index == 0.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: f033c26de5a5734625d2dd1dc196745fae186f1b , < 3af6c5ac72dc5b721058132a0a1d7779e443175e (git)
Affected: f033c26de5a5734625d2dd1dc196745fae186f1b , < 51c4440b9d3fd7c8234e6de9170a487c03506e53 (git)
Affected: f033c26de5a5734625d2dd1dc196745fae186f1b , < 00bb549d7d63a21532e76e4a334d7807a54d9f31 (git)
Create a notification for this product.
Linux Linux Affected: 6.4
Unaffected: 0 , < 6.4 (semver)
Unaffected: 6.6.26 , ≤ 6.6.* (semver)
Unaffected: 6.8.5 , ≤ 6.8.* (semver)
Unaffected: 6.9 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-36019",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-30T16:11:04.952877Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:47:34.967Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:30:12.601Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/3af6c5ac72dc5b721058132a0a1d7779e443175e"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/51c4440b9d3fd7c8234e6de9170a487c03506e53"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/00bb549d7d63a21532e76e4a334d7807a54d9f31"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/base/regmap/regcache-maple.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3af6c5ac72dc5b721058132a0a1d7779e443175e",
              "status": "affected",
              "version": "f033c26de5a5734625d2dd1dc196745fae186f1b",
              "versionType": "git"
            },
            {
              "lessThan": "51c4440b9d3fd7c8234e6de9170a487c03506e53",
              "status": "affected",
              "version": "f033c26de5a5734625d2dd1dc196745fae186f1b",
              "versionType": "git"
            },
            {
              "lessThan": "00bb549d7d63a21532e76e4a334d7807a54d9f31",
              "status": "affected",
              "version": "f033c26de5a5734625d2dd1dc196745fae186f1b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/base/regmap/regcache-maple.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.4"
            },
            {
              "lessThan": "6.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.26",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.26",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.5",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nregmap: maple: Fix cache corruption in regcache_maple_drop()\n\nWhen keeping the upper end of a cache block entry, the entry[] array\nmust be indexed by the offset from the base register of the block,\ni.e. max - mas.index.\n\nThe code was indexing entry[] by only the register address, leading\nto an out-of-bounds access that copied some part of the kernel\nmemory over the cache contents.\n\nThis bug was not detected by the regmap KUnit test because it only\ntests with a block of registers starting at 0, so mas.index == 0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is a regmap register-cache operation reached only through local device interfaces \u2014 a GPIO line read via /dev/gpiochipN ioctl or /sys/class/gpio, driver ops, or suspend/resume. There is no network or adjacent-network path into regcache_drop_region().\nAC:L - The trigger is fully deterministic: the 0xC00\u20130xC04 cache block is created at probe from static reg_defaults, so a single read of an Arizona GPIO line configured as input reliably executes the out-of-bounds kmemdup with no race and no memory-layout precondition the attacker must win.\nPR:L - An unprivileged local user with access to the GPIO character device or legacy sysfs GPIO interface \u2014 routinely granted to a gpio group or system user on the Android phones and embedded boards that carry WM5102/WM5110 codecs \u2014 can invoke the path repeatedly. No root or capability check guards regcache_drop_region() itself.\nUI:N - The attacker performs the GPIO read directly; no victim action, mount, or file open is needed. Cache corruption is also propagated to hardware autonomously on the next suspend/resume cycle.\nS:U - The out-of-bounds read, the corrupted cache, and the resulting hardware misconfiguration are all managed by the same kernel security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - Up to 32 bytes of arbitrary kernel heap memory roughly 24 KB beyond a known slab object are copied into the register cache and then read back by userspace (per-bit via GPIO line values, whole registers via regmap debugfs), and the read offset is unbounded in general since it scales with the block\u0027s base register address. Repeated triggering samples fresh heap contents, enabling kernel pointer and data disclosure that defeats KASLR.\nI:H - The commit is titled \"Fix cache corruption\" \u2014 kernel memory overwrites the authoritative register cache, and those attacker-uncontrolled values are subsequently written to the real device by regmap_update_bits() and regcache_sync(), reconfiguring physical codec GPIO direction, level, polarity, and pin function. This is uncontrolled modification of both kernel state and hardware state.\nA:H - The far out-of-bounds read can dereference unmapped memory and oops \u2014 guaranteed on KASAN builds and plausible on the sparse direct maps of the embedded/ARM systems these codecs ship in. Independently, garbage written into codec GPIO control registers can assert reset/enable lines and render the audio device or attached hardware inoperable."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:31:39.239Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3af6c5ac72dc5b721058132a0a1d7779e443175e"
        },
        {
          "url": "https://git.kernel.org/stable/c/51c4440b9d3fd7c8234e6de9170a487c03506e53"
        },
        {
          "url": "https://git.kernel.org/stable/c/00bb549d7d63a21532e76e4a334d7807a54d9f31"
        }
      ],
      "title": "regmap: maple: Fix cache corruption in regcache_maple_drop()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-36019",
    "datePublished": "2024-05-30T14:59:42.840Z",
    "dateReserved": "2024-05-17T13:50:33.157Z",
    "dateUpdated": "2026-08-05T11:31:39.239Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-36019",
      "date": "2026-08-08",
      "epss": "0.00241",
      "percentile": "0.15254"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-36019\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-30T15:15:49.027\",\"lastModified\":\"2026-06-17T07:35:58.143\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nregmap: maple: Fix cache corruption in regcache_maple_drop()\\n\\nWhen keeping the upper end of a cache block entry, the entry[] array\\nmust be indexed by the offset from the base register of the block,\\ni.e. max - mas.index.\\n\\nThe code was indexing entry[] by only the register address, leading\\nto an out-of-bounds access that copied some part of the kernel\\nmemory over the cache contents.\\n\\nThis bug was not detected by the regmap KUnit test because it only\\ntests with a block of registers starting at 0, so mas.index == 0.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: regmap: maple: corrige la corrupci\u00f3n de la cach\u00e9 en regcache_maple_drop() Cuando se mantiene el extremo superior de una entrada de bloque de cach\u00e9, la matriz de entrada[] debe indexarse seg\u00fan el desplazamiento del registro base de el bloque, es decir, max - mas.index. El c\u00f3digo indexaba la entrada [] solo por la direcci\u00f3n de registro, lo que generaba un acceso fuera de los l\u00edmites que copiaba parte de la memoria del kernel sobre el contenido de la cach\u00e9. Este error no fue detectado por la prueba regmap KUnit porque solo prueba con un bloque de registros que comienza en 0, por lo que mas.index == 0.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/base/regmap/regcache-maple.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"f033c26de5a5734625d2dd1dc196745fae186f1b\",\"lessThan\":\"3af6c5ac72dc5b721058132a0a1d7779e443175e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f033c26de5a5734625d2dd1dc196745fae186f1b\",\"lessThan\":\"51c4440b9d3fd7c8234e6de9170a487c03506e53\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f033c26de5a5734625d2dd1dc196745fae186f1b\",\"lessThan\":\"00bb549d7d63a21532e76e4a334d7807a54d9f31\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/base/regmap/regcache-maple.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.4\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.4\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.26\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.8.5\",\"lessThanOrEqual\":\"6.8.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.9\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.2}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-05-30T16:11:04.952877Z\",\"id\":\"CVE-2024-36019\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-125\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.4\",\"versionEndExcluding\":\"6.6.26\",\"matchCriteriaId\":\"C9C9F649-5E73-4413-8AB4-A1022F98B8DA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.8.5\",\"matchCriteriaId\":\"DBD6C99E-4250-4DFE-8447-FF2075939D10\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"22BEDD49-2C6D-402D-9DBF-6646F6ECD10B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"DF73CB2A-DFFD-46FB-9BFE-AA394F27EA37\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/00bb549d7d63a21532e76e4a334d7807a54d9f31\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3af6c5ac72dc5b721058132a0a1d7779e443175e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/51c4440b9d3fd7c8234e6de9170a487c03506e53\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/00bb549d7d63a21532e76e4a334d7807a54d9f31\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3af6c5ac72dc5b721058132a0a1d7779e443175e\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/51c4440b9d3fd7c8234e6de9170a487c03506e53\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T18:53:33+00:00",
      "cve": "CVE-2024-36019",
      "id": "CVE-2024-36019",
      "initial_release_date": "2024-05-30T00:00:00+00:00",
      "product_status:fixed": "279",
      "product_status:known_affected": "28",
      "product_status:known_not_affected": "84",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: regmap: maple: Fix cache corruption in regcache_maple_drop()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-36019.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/3af6c5ac72dc5b721058132a0a1d7779e443175e\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/51c4440b9d3fd7c8234e6de9170a487c03506e53\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/00bb549d7d63a21532e76e4a334d7807a54d9f31\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T03:30:12.601Z\"}}, {\"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-36019\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-05-30T16:11:04.952877Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-30T16:11:09.529Z\"}, \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"title\": \"regmap: maple: Fix cache corruption in regcache_maple_drop()\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The vulnerable code is a regmap register-cache operation reached only through local device interfaces \\u2014 a GPIO line read via /dev/gpiochipN ioctl or /sys/class/gpio, driver ops, or suspend/resume. There is no network or adjacent-network path into regcache_drop_region().\\nAC:L - The trigger is fully deterministic: the 0xC00\\u20130xC04 cache block is created at probe from static reg_defaults, so a single read of an Arizona GPIO line configured as input reliably executes the out-of-bounds kmemdup with no race and no memory-layout precondition the attacker must win.\\nPR:L - An unprivileged local user with access to the GPIO character device or legacy sysfs GPIO interface \\u2014 routinely granted to a gpio group or system user on the Android phones and embedded boards that carry WM5102/WM5110 codecs \\u2014 can invoke the path repeatedly. No root or capability check guards regcache_drop_region() itself.\\nUI:N - The attacker performs the GPIO read directly; no victim action, mount, or file open is needed. Cache corruption is also propagated to hardware autonomously on the next suspend/resume cycle.\\nS:U - The out-of-bounds read, the corrupted cache, and the resulting hardware misconfiguration are all managed by the same kernel security authority. No VM, IOMMU, or sandbox boundary is crossed.\\nC:H - Up to 32 bytes of arbitrary kernel heap memory roughly 24 KB beyond a known slab object are copied into the register cache and then read back by userspace (per-bit via GPIO line values, whole registers via regmap debugfs), and the read offset is unbounded in general since it scales with the block\u0027s base register address. Repeated triggering samples fresh heap contents, enabling kernel pointer and data disclosure that defeats KASLR.\\nI:H - The commit is titled \\\"Fix cache corruption\\\" \\u2014 kernel memory overwrites the authoritative register cache, and those attacker-uncontrolled values are subsequently written to the real device by regmap_update_bits() and regcache_sync(), reconfiguring physical codec GPIO direction, level, polarity, and pin function. This is uncontrolled modification of both kernel state and hardware state.\\nA:H - The far out-of-bounds read can dereference unmapped memory and oops \\u2014 guaranteed on KASAN builds and plausible on the sparse direct maps of the embedded/ARM systems these codecs ship in. Independently, garbage written into codec GPIO control registers can assert reset/enable lines and render the audio device or attached hardware inoperable.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"f033c26de5a5734625d2dd1dc196745fae186f1b\", \"lessThan\": \"3af6c5ac72dc5b721058132a0a1d7779e443175e\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f033c26de5a5734625d2dd1dc196745fae186f1b\", \"lessThan\": \"51c4440b9d3fd7c8234e6de9170a487c03506e53\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f033c26de5a5734625d2dd1dc196745fae186f1b\", \"lessThan\": \"00bb549d7d63a21532e76e4a334d7807a54d9f31\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/base/regmap/regcache-maple.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.4\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.4\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.6.26\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8.5\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.8.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/base/regmap/regcache-maple.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/3af6c5ac72dc5b721058132a0a1d7779e443175e\"}, {\"url\": \"https://git.kernel.org/stable/c/51c4440b9d3fd7c8234e6de9170a487c03506e53\"}, {\"url\": \"https://git.kernel.org/stable/c/00bb549d7d63a21532e76e4a334d7807a54d9f31\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nregmap: maple: Fix cache corruption in regcache_maple_drop()\\n\\nWhen keeping the upper end of a cache block entry, the entry[] array\\nmust be indexed by the offset from the base register of the block,\\ni.e. max - mas.index.\\n\\nThe code was indexing entry[] by only the register address, leading\\nto an out-of-bounds access that copied some part of the kernel\\nmemory over the cache contents.\\n\\nThis bug was not detected by the regmap KUnit test because it only\\ntests with a block of registers starting at 0, so mas.index == 0.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.26\", \"versionStartIncluding\": \"6.4\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8.5\", \"versionStartIncluding\": \"6.4\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9\", \"versionStartIncluding\": \"6.4\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:31:39.239Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-36019\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:31:39.239Z\", \"dateReserved\": \"2024-05-17T13:50:33.157Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-30T14:59:42.840Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.