Security readout for executives and security teams
Plain-English summary
A Linux kernel flaw in the RDMA/rtrs subsystem can cause a NULL-pointer crash during data handling. Systems using the affected RDMA functionality may suffer kernel failure and service interruption. The supplied critical score also claims confidentiality and integrity impact, but the technical evidence provided primarily demonstrates a crash; broader impact is not established here.
Executive priority
Treat as urgent for RDMA-enabled production infrastructure because a kernel crash could disrupt critical services. First establish whether the relevant subsystem is present and used, then patch affected systems through supported vendor channels. Systems without this RDMA path are lower priority. Do not interpret the critical score alone as proof of active attacks or confirmed data compromise.
Technical view
The ib_sge list variable was scoped inside an always_invalidate block, leaving subsequent operations unable to access the expected value. The resulting path can reach rxe_mr_copy through the rdma_rxe requester and dereference NULL. Referenced Linux stable commits move the declaration so the list remains accessible throughout the function.
Likely exposure
Exposure is limited to Linux systems running an affected kernel and exercising the relevant RDMA/rtrs path, including the demonstrated rdma_rxe context. The bundle flags version records including 5.8, 5.10.233, 5.15.176, 6.1.124, 6.6.70, 6.12.9, and 6.13, but does not clearly define complete affected ranges or distribution backports.
Exploitation context
The supplied CVSS 3.1 rating is 9.8 with network reachability, low complexity, no privileges, and no interaction. However, this CVE is not listed as KEV, and the provided sources do not establish active exploitation, public weaponization, or reliable impact beyond the documented kernel crash.
Researcher notes
CWE-476 matches the documented NULL-pointer dereference. The supplied CVSS vector asserts high confidentiality, integrity, and availability impact, while the description and trace substantiate availability impact most clearly. Complete affected ranges, prerequisite protocol state, distribution-specific fixes, and exploitability are not resolved by the bundle. The duplicated commit-style version entries also warrant confirmation against authoritative vendor tracking.
Mitigation direction
- Apply a vendor-supported kernel update containing the applicable referenced stable correction or backport.
- Consult the Linux distribution or appliance vendor for precise affected and fixed package versions.
- Prioritize RDMA-enabled systems supporting critical, clustered, storage, or latency-sensitive workloads.
- Track systems awaiting updates and apply vendor-recommended temporary controls if published.
Validation and detection
- Inventory kernel versions and identify systems configured to use RDMA/rtrs or rdma_rxe.
- Compare installed kernel packages with vendor advisories and applicable stable commit backports.
- Review kernel logs for NULL dereferences containing rxe_mr_copy, copy_data, or rxe_requester.
- After updating, confirm the running kernel is the corrected build and repeat operational RDMA testing.
Public sources used
- CVE Program record
- CVE List V5 record
- Linux RDMA discussion and crash trace
- Linux stable correction 7eaa71f
- Linux stable correction 1433780
- Linux stable correction 32e1e74
- Linux stable correction b238f61
- Linux stable correction 6ffb5c1
- Linux stable correction fb514b3
- Debian LTS announcement
- Debian LTS announcement
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-476: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2024-36476 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9LinuxCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/7eaa71f56a6f7ab87957213472dc6d4055862722CVE reference, Linux
- https://git.kernel.org/stable/c/143378075904e78b3b2a810099bcc3b3d82d762fCVE reference, Linux
- https://git.kernel.org/stable/c/32e1e748a85bd52b20b3857d80fd166d22fa455aCVE reference, Linux
- https://git.kernel.org/stable/c/b238f61cc394d5fef27b26d7d9aa383ebfddabb0CVE reference, Linux
- https://git.kernel.org/stable/c/6ffb5c1885195ae5211a12b4acd2d51843ca41b0CVE reference, Linux
- https://git.kernel.org/stable/c/fb514b31395946022f13a08e06a435f53cf9e8b3CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/03/msg00001.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/03/msg00002.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
NULL Pointer Dereference
NULL Pointer Dereference represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.