CVE-2024-36014 – This CVE describes a null pointer dereference v... (How to Fix)

Q: What is the severity of CVE-2024-36014?

CVE-2024-36014 has a CVSS score of 5.5 (MEDIUM). This CVE describes a null pointer dereference vulnerability in the ARM Mali Display Processor (MaliDP) driver of the Linux kernel. If exploited, it could cause a kernel panic leading to denial of service. Systems using affected ARM Mali GPU hardware with vulnerable kernel versions are at risk.

📋 TL;DR

This CVE describes a null pointer dereference vulnerability in the ARM Mali Display Processor (MaliDP) driver of the Linux kernel. If exploited, it could cause a kernel panic leading to denial of service. Systems using affected ARM Mali GPU hardware with vulnerable kernel versions are at risk.

💻 Affected Systems

Products:

Linux kernel with ARM Mali Display Processor (MaliDP) driver

Versions: Specific kernel versions containing the vulnerable code (check git commits for exact ranges)

Operating Systems: Linux distributions with ARM Mali GPU support

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects systems with ARM Mali GPU hardware. The vulnerability is in the display driver code path.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic leading to system crash and denial of service, potentially requiring physical reboot.

🟠

Likely Case

System instability or crash when specific display operations are performed with ARM Mali GPU.

🟢

If Mitigated

Minor system instability that may be recoverable without full reboot.

🌐 Internet-Facing: LOW - Requires local access or ability to execute code on the system.

🏢 Internal Only: MEDIUM - Local users or processes could trigger the vulnerability causing system instability.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Requires local access to trigger the vulnerable code path. Likely requires specific display operations.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Kernel versions containing the fix commits (335cc45ef2b81b68be63c698b4f867a530bdf7a5 and related)

Vendor Advisory: https://git.kernel.org/stable/c/335cc45ef2b81b68be63c698b4f867a530bdf7a5

Restart Required: Yes

Instructions:

1. Update Linux kernel to version containing the fix commits. 2. Rebuild kernel if compiling from source. 3. Reboot system to load patched kernel.

🔧 Temporary Workarounds

Disable ARM Mali GPU if not needed

linux

Remove or blacklist the malidp kernel module to prevent loading of vulnerable driver

echo 'blacklist malidp' >> /etc/modprobe.d/blacklist.conf
rmmod malidp

🧯 If You Can't Patch

Restrict local user access to systems with ARM Mali GPU hardware
Monitor system logs for kernel panic events related to display operations

🔍 How to Verify

Check if Vulnerable:

Check kernel version and if malidp module is loaded: lsmod | grep malidp

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version includes fix commits and malidp module loads without issues

📡 Detection & Monitoring

Log Indicators:

Kernel panic messages
NULL pointer dereference errors in dmesg
Display subsystem crashes

Network Indicators:

None - local vulnerability only

SIEM Query:

search 'kernel panic' OR 'NULL pointer dereference' AND 'malidp' in system logs

📊 Metadata

CVE ID: CVE-2024-36014

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-476

Published: May 29, 2024

Last Updated: November 4, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-36014, you might also want to check these: