PatchaPalooza

CVE-2024-36024: drm/amd/display: Disable idle reallow as part of command/gpint execution

CVE-2024-36024 is a vulnerability in drm/amd/display: Disable idle reallow as part of command/gpint execution, rated Moderate by Microsoft, with a CVSS 3.1 base score of 4.1 (Medium). An attacker can exploit it by an attacker with local access, with high privileges and without user interaction. Microsoft has not reported exploitation in the wild. The EPSS model estimates a 0.16% probability of exploitation activity in the next 30 days, higher than 5% of all scored vulnerabilities. Microsoft released the fix on 4 September 2025, outside Patch Tuesday. It affects 23 products in 1 product family (Other).

Key facts

CVE ID
CVE-2024-36024
Severity
Medium CVSS 4.1
Microsoft severity
Moderate
Exploited in the wild
No
Publicly disclosed
No
Weakness
CWE-362
EPSS
0.16% (percentile 5%)
CISA KEV
Not listed
Released
Last updated
Patch Tuesday
May 2024 Patch Tuesday
Product families
Other

CVSS score and vector

Microsoft scores CVE-2024-36024 at 4.1 (temporal 4.1) using CVSS 3.1. Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H

MetricValue
Attack vectorLocal
Attack complexityHigh
Privileges requiredHigh
User interactionNone
ScopeUnchanged
Confidentiality impactNone
Integrity impactNone
Availability impactHigh

NVD scores it 4.7 (MEDIUM) with CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H.

Frequently asked questions (Microsoft)

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?

One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.

Affected products (23)

Other

ProductSecurity updateTypeFixed buildRestart
20613-17084
20725-17084
20823-17084
20925-17086
21094-17084
21093-17086
21332-17084
21474-17084
21580-17084
21932-17084Release NotesSecurity Update
20412-17084
17087-17086
20553-17084
20788-17084
20860-17084
20956-17084
21248-17084
21308-17084
21344-17084
21443-17084
21626-17084
21684-17084
21892-17084Release NotesSecurity Update

NIST NVD data

NVD status
Analyzed
NVD CVSS
4.7 (MEDIUM)
NVD weakness
CWE-362
Published to NVD
NVD last modified

Affected configurations (CPE)

ProductVulnerable versions
linux kernelfrom 4.15, before 6.8.6

References

Revision history

VersionDateDescription
1.0Information published.
2.0Information published.
3.0Information published.
4.0Information published.
5.0Information published.
6.0Information published.
7.0Information published.
8.0Information published.
9.0Information published.
10.0Information published.
11.0Information published.
12.0Information published.
13.0Information published.
14.0Information published.
15.0Information published.
16.0Information published.
17.0Information published.
18.0Information published.
19.0Information published.
20.0Information published.

Sources