CVE-2024-36978

Name	CVE-2024-36978
Description	In the Linux kernel, the following vulnerability has been resolved: net: sched: sch_multiq: fix possible OOB write in multiq_tune() q->bands will be assigned to qopt->bands to execute subsequent code logic after kmalloc. So the old q->bands should not be used in kmalloc. Otherwise, an out-of-bounds write will occur.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
linux (PTS)	buster	4.19.249-2	fixed
	buster (security)	4.19.316-1	fixed
	bullseye (security), bullseye	5.10.218-1	vulnerable
	bookworm	6.1.94-1	vulnerable
	bookworm (security)	6.1.90-1	vulnerable
	trixie	6.8.12-1	vulnerable
	sid	6.9.7-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
linux	source	buster	(not affected)
linux	source	(unstable)	6.9.7-1

[buster] - linux <not-affected> (Vulnerable code not present)
https://git.kernel.org/linus/affc18fdc694190ca7575b9a86632a73b9fe043d (6.10-rc3)