CVE-2024-36958: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-36958 affects the Linux kernel's Network File System daemon (NFSD) component. The vulnerability was discovered in the nfsd4_encode_fattr4() function where an uninitialized args.acl variable could lead to a system crash due to an unconditional call to kfree(). The issue was reported by Scott Mayhew and was publicly disclosed on May 30, 2024 (NVD, Kernel Commit).

The vulnerability stems from a coding error in the fs/nfsd/nfs4xdr.c file where the args.acl pointer was not properly initialized before being used in a kfree() operation. The bug was introduced in commit 83ab8678ad0c ("NFSD: Add struct nfsd4_fattr_args"). The fix involves initializing args.acl to NULL early in the nfsd4_encode_fattr4() function to prevent the crash condition (Kernel Fix).

The vulnerability could cause a system crash when the NFSD service processes certain NFS v4 requests, potentially leading to a denial of service condition for systems running the affected NFS server implementation (NVD).

The vulnerability requires the system to be running as an NFS server with the NFSD service enabled. No public exploits have been reported at the time of assessment (NVD).

The vulnerability has been fixed in multiple Linux kernel versions. Ubuntu has released patches for version 24.04 LTS (Noble) in linux-6.8.0-40.40 and other affected packages. Users should update their systems to the patched versions. For Ubuntu 24.04, the fixed packages include linux-image-6.8.0-40-lowlatency (6.8.0-40.40.1) and related kernel packages (Ubuntu Security).