What is CVE-2024-36031?

CVE-2024-36031 is a Critical severity Linux kernel vulnerability with a CVSS score of 9.8 out of 10. CVE-2024-36031 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

What is the CVSS score for CVE-2024-36031?

CVE-2024-36031 has a CVSS score of 9.8 out of 10, rated Critical severity. The vector string is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Is there a patch available for CVE-2024-36031?

No patch is currently available for CVE-2024-36031. Monitor the NIST NVD and your Linux distribution's security advisories for updates.

Is CVE-2024-36031 actively exploited?

CVE-2024-36031 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

CVE-2024-36031

Critical

In the Linux kernel, the following vulnerability has been resolved: keys: Fix overwrite of key expiration on instantiation The expiry time of a key is unconditionally overwritten during instantiation, defaulting to turn it permanent. This causes a problem for DNS resolution as the expiration set by user-space is overwritten to TIME64_MAX, disabling further DNS updates. Fix this by restoring the condition that key_set_expiry is only called when the pre-parser sets a specific expiry.

Package Linux Kernel

Published 2024-05-30

Last modified 2025-11-04

CVSS version 3.1

Patch available

Awaiting data

CVSS 3.1 score

9.8

out of 10

Critical

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Vector string

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness type

CWE-324

CVE-2024-36031 is classified as CWE-324

See CWE-324 on MITRE CWE for full details on this weakness type.

References

The following references provide additional information about CVE-2024-36031 including vendor advisories, patch commits, exploit details, and third-party analysis. Links are sourced from the NIST NVD database.

Debian Security
https://lists.debian.org/debian-lts-announce/2024/06/msg00019.html
Kernel patch commit
https://git.kernel.org/stable/c/25777f3f4e1f371d16a594925f31e37ce07b6ec7
Patch
Kernel patch commit
https://git.kernel.org/stable/c/939a08bcd4334bad4b201e60bd0ae1f278d71d41
Patch
Kernel patch commit
https://git.kernel.org/stable/c/9da27fb65a14c18efd4473e2e82b76b53ba60252
Patch

7 patch commits total View all on NVD

Details

CVE ID CVE-2024-36031

Severity Critical

CVSS score 9.8 / 10

CVSS version 3.1

Published 2024-05-30

Modified 2025-11-04

KEV No

Patch Awaiting data

Package linux

Frequently asked questions

What is CVE-2024-36031?

CVE-2024-36031 is a Critical severity Linux kernel vulnerability with a CVSS score of 9.8 out of 10 . CVE-2024-36031 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
What is the CVSS score for CVE-2024-36031?

CVE-2024-36031 has a CVSS score of 9.8 out of 10, rated Critical severity (CVSS 3.1). The vector string is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Is there a patch available for CVE-2024-36031?

No patch is currently available for CVE-2024-36031. Monitor the NIST NVD and your Linux distribution's security advisories for updates.
Is CVE-2024-36031 actively exploited?

No — CVE-2024-36031 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.