LiveActive security incident?Get immediate response
CVE Record

CVE-2024-36020: i40e: fix vf may be used uninitialized in this function warning

In the Linux kernel, the following vulnerability has been resolved: i40e: fix vf may be used uninitialized in this function warning To fix the regression introduced by commit 52424f974bc5, which causes servers hang in very hard to reproduce conditions with resets races. Using two sources for the information is the root cause. In this function before the fix bumping v didn't mean bumping vf pointer. But the code used this variables interchangeably, so stale vf could point to different/not intended vf. Remove redundant "v" variable and iterate via single VF pointer across whole function instead to guarantee VF pointer validity.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This Linux kernel issue affects the i40e network driver. A regression could leave the driver using the wrong virtual function pointer during rare reset races, causing servers to hang. The source material does not provide CVSS, public exploitation, or broad impact details, so urgency depends mainly on whether affected i40e hardware and SR-IOV virtual functions are in use.

Executive priority

Handle this through normal kernel patch governance, with faster action for virtualization hosts, network-heavy servers, or appliances using Intel i40e devices. There is no sourced evidence of active exploitation, but server hangs can create business disruption where affected hardware is operationally important.

Technical view

CVE-2024-36020 is a Linux i40e driver regression introduced by commit 52424f974bc5. The vulnerable function used a redundant index variable and a VF pointer interchangeably, allowing a stale VF pointer to reference a different or unintended VF during reset races. Stable fixes remove the redundant variable and iterate consistently through the VF pointer.

Likely exposure

Exposure is most plausible on Linux systems using the i40e driver for Intel Ethernet devices, particularly where SR-IOV virtual functions and reset activity are present. The bundle lists affected Linux kernel entries including 4.19.312, 5.4.274, 5.10.215, 5.15.154, 6.1.85, 6.6.26, 6.8.5, and 6.9.

Exploitation context

The bundle states KEV is false and provides no evidence of active exploitation. The described impact is a hard-to-reproduce server hang caused by reset races, not a documented remote exploit path. Treat this primarily as an availability and operational stability risk until vendor-specific advisories say otherwise.

Researcher notes

The useful technical signal is the stale VF pointer caused by divergent index and pointer handling in the i40e reset path. Public data does not include CVSS, CWE, exploitability details, or a standalone mitigation. Validation should focus on driver presence, SR-IOV VF usage, kernel lineage, and vendor-fixed builds.

Mitigation direction

  • Identify systems running Linux with the i40e driver and Intel Ethernet hardware.
  • Prioritize hosts using SR-IOV virtual functions or frequent network device resets.
  • Apply vendor kernel updates containing the referenced stable i40e fixes.
  • Check Debian and device-vendor advisories for package-specific fixed versions.
  • Use vendor guidance if kernel updates are constrained by appliance or support requirements.

Validation and detection

  • Inventory running kernel versions on systems using i40e-supported network adapters.
  • Confirm whether SR-IOV virtual functions are enabled on those adapters.
  • Compare installed kernels against distribution advisories and fixed stable commits.
  • Review logs for i40e reset activity or unexplained server hangs.
  • Track Siemens or other appliance advisories if affected products are deployed.
Prepared
Confidence
medium
Sources
12

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2024-36020 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
3ADP providers
12Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc
CVECVE Program Container
siemens-SADPADP container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux76ed715836c6994bac29d9638e9314e6e3b08651, e88c2a1e28c5475065563d66c07ca879a9afbd07, 9abae363af5ced6adbf04c14366289540281fb26, c39de3ae5075ea5f78e097cb5720d4e52d5caed9, 52424f974bc53c26ba3f00300a00e9de9afcd972, 52424f974bc53c26ba3f00300a00e9de9afcd972, 52424f974bc53c26ba3f00300a00e9de9afcd972, 52424f974bc53c26ba3f00300a00e9de9afcd972, 02f949747e6fb767b29f7931d4bbf40911684e7aunaffected
LinuxLinux6.1, 0, 4.19.312, 5.4.274, 5.10.215, 5.15.154, 6.1.85, 6.6.26, 6.8.5, 6.9affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.