Security readout for executives and security teams
Plain-English summary
A malicious or compromised host may trigger a Linux confidential-computing virtual machine to return shared, decrypted network-driver memory to the normal page allocator. Reuse of that memory could undermine confidentiality, integrity, or availability. The supplied record rates this critical, but the practical risk is concentrated in affected CoCo VMs using the Hyper-V netvsc driver.
Executive priority
Treat as an urgent targeted remediation for confidential-computing workloads, especially where the host is outside the tenant's full trust boundary. Rapidly identify qualifying VMs and obtain fixed kernels from distribution vendors. Broad emergency action across ordinary Linux estates is not supported by the supplied evidence.
Technical view
The hv_netvsc driver mishandled failures from set_memory_decrypted(). When the operation failed but left pages shared, the driver could free those pages because it did not consult the GPADL decrypted state. The stable changes prevent decrypted or shared memory from being returned incorrectly to the allocator. The source bundle lists Linux releases including 5.16, 6.6.31, 6.8.10, and 6.9 as affected.
Likely exposure
Likely exposure is limited to affected Linux kernels running confidential-computing VMs with the Hyper-V netvsc driver and an untrusted or compromised host capable of forcing memory-state conversion failures. Ordinary Linux systems outside this configuration may not be practically exposed. The supplied version data is not sufficiently clear to define complete vulnerable ranges.
Exploitation context
The supplied sources do not establish active exploitation, and the CVE is not marked as CISA KEV. Exploitation requires influence from the VM host, materially narrowing the threat model while making the issue important for tenants relying on confidential-computing isolation from infrastructure operators. No public exploit evidence is included.
Researcher notes
The key condition is a failed encryption-state transition that nevertheless leaves memory shared. Correct handling depends on the GPADL decrypted flag before freeing pages. The record describes possible functional or security consequences but supplies no demonstrated disclosure, corruption, denial-of-service path, or exploitation evidence. Exact vulnerable version boundaries require vendor confirmation.
Mitigation direction
- Install a vendor-supported kernel containing the cited hv_netvsc stable fix.
- Prioritize confidential-computing VMs using Hyper-V networking or equivalent netvsc deployments.
- Check Linux distribution advisories for exact affected and fixed package versions.
- Restrict untrusted host administration and strengthen hypervisor management controls until patched.
Validation and detection
- Inventory confidential-computing Linux VMs and identify those loading the hv_netvsc driver.
- Record kernel and distribution package versions for each potentially exposed VM.
- Confirm the installed kernel includes the applicable cited stable commit or vendor backport.
- Review vendor advisories because the supplied affected-version list does not define complete ranges.
- Monitor affected VMs for unexplained memory, networking, or stability anomalies.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-36911 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9LinuxVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/a56fe611326332bf6b7126e5559590c57dcebad4CVE reference, Linux
- https://git.kernel.org/stable/c/4aaed9dbe8acd2b6114458f0498a617283d6275bCVE reference, Linux
- https://git.kernel.org/stable/c/bbf9ac34677b57506a13682b31a2a718934c0e31CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.