What is the CVSS score of CVE-2024-36913?

CVE-2024-36913 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.9%.

Which versions of Linux Kernel are affected by CVE-2024-36913?

A critical memory protection flaw in the Linux kernel's Hyper-V VMBus driver exposes confidential data in guest virtual machines running confidential computing workloads, with no public exploit…. A patch is available.

How to fix or mitigate CVE-2024-36913?

Within 24 hours, identify all systems running Linux Confidential Computing guest VMs on Hyper-V and assess their exposure to untrusted hypervisor threats. Within 7 days, plan and schedule kernel patching according to your change management process, prioritizing production confidential computing environments. Within 30 days, apply the stable kernel patch released by your Linux distribution or kernel maintainers to all affected systems, verifying successful application before returning to normal operations.

Linux Kernel CVE-2024-36913

CRITICAL

Exposure of Sensitive System Information Due to Uncleared Debug Information (CWE-1258)

2024-05-30 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Information Disclosure Linux Debian Linux

9.3

CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY

9.3 CRITICAL

AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

7.3 HIGH

Untrusted host is the local unauthenticated attacker (AV:L/PR:N) but must win a state-transition failure race (AC:H); crossing the CoCo confidentiality boundary is S:C with primary confidentiality impact.

3.1 AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:L

4.0 AV:L/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:L/SC:H/SI:N/SA:N

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 04, 2026 - 11:32 vuln.today

v1 (cvss_changed)

Re-analysis Queued

Aug 04, 2026 - 11:23 vuln.today

cvss_changed

Severity Changed

Aug 04, 2026 - 11:23 NVD

HIGH CRITICAL

CVSS changed

Aug 04, 2026 - 11:23 NVD

8.1 (HIGH) 9.3 (CRITICAL)

CVE Published

May 30, 2024 - 16:15 cve.org

HIGH 8.1

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

Drivers: hv: vmbus: Leak pages if set_memory_encrypted() fails

In CoCo VMs it is possible for the untrusted host to cause set_memory_encrypted() or set_memory_decrypted() to fail such that an error is returned and the resulting memory is shared. Callers need to take care to handle these errors to avoid returning decrypted (shared) memory to the page allocator, which could lead to functional or security issues.

VMBus code could free decrypted pages if set_memory_encrypted()/decrypted() fails. Leak the pages if this happens.

AnalysisAI

Information exposure in the Linux kernel Hyper-V VMBus driver affects Confidential Computing (CoCo) guest VMs where a malicious hypervisor can force set_memory_encrypted()/set_memory_decrypted() to fail; the driver previously freed the still-shared (decrypted) pages back to the page allocator, potentially leaking confidential guest data to the untrusted host or causing memory corruption. The fix intentionally leaks (does not free) the affected pages when re-encryption fails, trading a small memory leak for guest confidentiality integrity. Fixed in stable kernel commits with no public exploit identified and no CISA KEV listing, though the assigned CVSS base score is 9.3 due to the confidential-computing trust boundary being crossed.

Technical ContextAI

The flaw is in drivers/hv/ (Hyper-V VMBus transport) as used by CoCo guests such as AMD SEV-SNP or Intel TDX VMs running under Microsoft Hyper-V. In these architectures guest memory is encrypted by hardware and specific buffers must be explicitly toggled between private (encrypted) and shared (decrypted) state via set_memory_decrypted()/set_memory_encrypted() so the host can perform I/O. The threat model for CoCo treats the host/hypervisor as untrusted, so it can deliberately cause the encryption-state transition hypercalls to return an error while leaving the page in the shared state. The affected VMBus code did not check these return values and proceeded to free the pages back to the kernel page allocator while they were still decrypted/shared. This maps to CWE-1258 (exposure of sensitive system information / improper handling of security state during a state transition): reusing a page that the host can still read undermines the memory-encryption guarantee that CoCo is designed to provide.

RemediationAI

Update to a patched stable Linux kernel that includes the VMBus fix; the fix is present in the upstream stable commits 03f5a999adba062456c8c818a683beb1b498983a, 6123a4e8e25bd40cf44db14694abac00e6b664e6, 7f2afcbfe4f6b6047b5f68db5067b7321e5be125, and e813a0fc2e597146e9cebea61ced9c796d4e308f (https://git.kernel.org/stable/c/03f5a999adba062456c8c818a683beb1b498983a and the companion commits). Debian users should apply the kernel update described in https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html. Because the practical impact is confined to CoCo guests, an interim compensating control is to avoid running SEV-SNP/TDX confidential VMs on untrusted or unpatched Hyper-V hosts, or to defer confidential-computing workloads on Hyper-V until the guest kernel is patched; note this reduces functionality (no confidential VM protection) rather than fixing the flaw. There is no need to disable VMBus on trusted-host deployments, as the issue is not exploitable when the hypervisor is trusted.