CVE-2024-36953 – A NULL pointer dereference vulnerability in the... (How to Fix)

Q: What is the severity of CVE-2024-36953?

CVE-2024-36953 has a CVSS score of 5.5 (MEDIUM). A NULL pointer dereference vulnerability in the Linux kernel's KVM (Kernel-based Virtual Machine) subsystem for ARM64 architecture. When handling GICv2 virtual interrupt controller ioctl operations with invalid CPU IDs, the system could crash or become unstable. This affects systems running KVM virtualization on ARM64 hardware.

📋 TL;DR

A NULL pointer dereference vulnerability in the Linux kernel's KVM (Kernel-based Virtual Machine) subsystem for ARM64 architecture. When handling GICv2 virtual interrupt controller ioctl operations with invalid CPU IDs, the system could crash or become unstable. This affects systems running KVM virtualization on ARM64 hardware.

💻 Affected Systems

Products:

Linux Kernel

Versions: Specific kernel versions with the vulnerable code (check git commits for exact ranges)

Operating Systems: Linux distributions running on ARM64 architecture with KVM enabled

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects ARM64 systems with KVM virtualization enabled and using GICv2 interrupt controller.

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic leading to system crash and denial of service, potentially affecting all virtual machines on the host.

🟠

Likely Case

Kernel crash or instability when malicious userspace processes send malformed ioctl requests to the KVM subsystem.

🟢

If Mitigated

Proper input validation prevents the crash, maintaining system stability.

🌐 Internet-Facing: LOW - Requires local access to the system and KVM privileges.

🏢 Internal Only: MEDIUM - Local users with KVM access could crash the kernel, affecting all VMs on the host.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Requires local access and ability to make KVM ioctl calls. Likely requires CAP_SYS_ADMIN or KVM group membership.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Kernel versions containing the fix commits (01981276d64e, 17db92da8be5, etc.)

Vendor Advisory: https://git.kernel.org/stable/c/01981276d64e542c177b243f7c979fee855d5487

Restart Required: Yes

Instructions:

1. Update to a patched kernel version from your distribution. 2. Reboot the system. 3. Verify the kernel version includes the fix commits.

🔧 Temporary Workarounds

Disable KVM on ARM64

linux

Disable KVM virtualization if not required

echo 'blacklist kvm' >> /etc/modprobe.d/blacklist.conf
rmmod kvm

Restrict KVM access

linux

Limit which users can access KVM devices

chmod 600 /dev/kvm
chown root:root /dev/kvm

🧯 If You Can't Patch

Restrict KVM device access to trusted users only
Monitor for suspicious ioctl calls to KVM subsystem

🔍 How to Verify

Check if Vulnerable:

Check if running an affected kernel version on ARM64 with KVM enabled: 'uname -r' and 'lsmod | grep kvm'

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version includes fix commits: 'git log --oneline | grep -E "01981276d64e|17db92da8be5"' or check distribution patch notes

📡 Detection & Monitoring

Log Indicators:

Kernel panic logs
NULL pointer dereference in kernel logs
KVM subsystem crash messages

Network Indicators:

Not network exploitable

SIEM Query:

search 'kernel: BUG: unable to handle kernel NULL pointer dereference' AND 'vgic_v2_parse_attr'

📊 Metadata

CVE ID: CVE-2024-36953

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-476

Published: May 30, 2024

Last Updated: December 23, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-36953, you might also want to check these: