Analyst readout for executives and security teams
Plain-English summary
CVE-2024-36004 is a Linux kernel driver reliability issue in Intel i40e networking. The reported case involved SR-IOV testing when i40e and i40iw/irdma were loaded, triggering a kernel workqueue warning. Public sources do not show active exploitation or business-impact details beyond the kernel warning and resolved driver change.
Executive priority
Treat as a targeted kernel maintenance item, not an emergency, unless critical infrastructure depends on Intel i40e with RDMA or SR-IOV. Patch through normal kernel update channels and monitor vendor advisories.
Technical view
The i40e driver allocated its service workqueue with WQ_MEM_RECLAIM, then flushed work from a non-WQ_MEM_RECLAIM RDMA/Infiniband path. Linux resolved this by removing the WQ_MEM_RECLAIM flag from the i40e workqueue, matching a similar ice driver fix.
Likely exposure
Exposure appears limited to Linux systems using the Intel i40e network driver, especially with i40iw/irdma/RDMA and SR-IOV configurations. The CVE record lists multiple affected Linux stable branches, but no CPEs or vendor-specific appliance inventory details are provided.
Exploitation context
The source bundle does not show KEV listing, active exploitation, public exploit activity, or a remote attack path. Evidence is a customer-reported kernel warning during SR-IOV testing with specific drivers loaded.
Researcher notes
The public description is narrow and does not provide CVSS, CWE, exploitability analysis, or complete affected product mapping. Validation should focus on driver presence, kernel branch status, and whether distribution backports include one of the listed stable commits.
Mitigation direction
- Apply vendor-supported Linux kernel updates containing the referenced stable fixes.
- Prioritize hosts using Intel i40e with RDMA, i40iw/irdma, or SR-IOV enabled.
- Check Debian and other OS vendor advisories for backported kernel packages.
- Avoid unsupported manual driver changes unless directed by the OS vendor.
Validation and detection
- Inventory Linux hosts for loaded i40e, i40iw, irdma, and ib_core modules.
- Compare running kernel packages against vendor advisories and stable fix availability.
- Review kernel logs for check_flush_dependency warnings involving i40e_service_task.
- Confirm updated kernels include the referenced i40e WQ_MEM_RECLAIM removal fix.
Public sources used
- CVE Program
- CVE List V5
- Linux stable commit 09b54d29
- Linux stable commit 546d0fe9
- Linux stable commit fbbb2404
- Linux stable commit ff7431f8
- Linux stable commit 152ed360
- Linux stable commit 8d6105f6
- Linux stable commit 1594dac8
- Linux stable commit 2cc7d150
- Debian LTS advisory DLA 2024-06 msg00017
- Debian LTS advisory DLA 2024-06 msg00020
Based on public source material and reviewed before publication.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-36004 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/09b54d29f05129b092f7c793a70b689ffb3c7b2cCVE reference, Linux
- https://git.kernel.org/stable/c/546d0fe9d76e8229a67369f9cb61e961d99038bdCVE reference, Linux
- https://git.kernel.org/stable/c/fbbb2404340dd6178e281bd427c271f7d5ec1d22CVE reference, Linux
- https://git.kernel.org/stable/c/ff7431f898dd00892a545b7d0ce7adf5b926944fCVE reference, Linux
- https://git.kernel.org/stable/c/152ed360cf2d273f88fc99a518b7eb868aae2939CVE reference, Linux
- https://git.kernel.org/stable/c/8d6105f637883c8c09825e962308c06e977de4f0CVE reference, Linux
- https://git.kernel.org/stable/c/1594dac8b1ed78f9e75c263327e198a2e5e25b0eCVE reference, Linux
- https://git.kernel.org/stable/c/2cc7d150550cc981aceedf008f5459193282425cCVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2024/06/msg00017.htmlCVE reference, CVE · x_transferred
- https://lists.debian.org/debian-lts-announce/2024/06/msg00020.htmlCVE reference, CVE · x_transferred
- https://cert-portal.siemens.com/productcert/html/ssa-265688.htmlCVE reference, siemens-SADP
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.