Medium 6.5Published May 30, 2024

CVE-2024-36916blk-iocost: avoid out of bounds shift

Updated under an hour ago (Oct 28, 2026, 2:40 AM ET)

Does this affect you?

It affects Linux and 6 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: blk-iocost: avoid out of bounds shift UBSAN catches undefined behavior in blk-iocost, where sometimes iocg->delay is shifted right by a number that is too large, resulting in undefined behavior on some architectures. [ 186.556576] ------------[ cut here ]------------ UBSAN: shift-out-of-bounds in block/blk-iocost.c:1366:23 shift exponent 64 is too large for 64-bit type 'u64' (aka 'unsigned long long') CPU: 16 PID: 0 Comm: swapper/16 Tainted: G S E N 6.9.0-0_fbk700_debug_rc2_kbuilder_0_gc85af715cac0 #1 Hardware name: Quanta Twin Lakes MP/Twin Lakes Passive MP, BIOS F09_3A23 12/08/2020 Call Trace: <IRQ> dump_stack_lvl+0x8f/0xe0 __ubsan_handle_shift_out_of_bounds+0x22c/0x280 iocg_kick_delay+0x30b/0x310 ioc_timer_fn+0x2fb/0x1f80 __run_timer_base+0x1b6/0x250 ... Avoid that undefined behavior by simply taking the "delay = 0" branch if the shift is too large. I am not sure what the symptoms of an undefined value delay will be, but I suspect it could be more than a little annoying to debug.

CVSS: 6.5 MEDIUM (v3.1, CISA ADP)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 14, 2026
First seen by InfoSec Signals: Oct 14, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	5160a5a53c0c4ae3708959d9465ea43ad5d90542 builds before 62accf6c1d7b433752cb3591bba8967b7a801ad5; 5160a5a53c0c4ae3708959d9465ea43ad5d90542 builds before 844fc023e9f14a4fb1de5ae1eaefafd6d69c5fa1; from 5160a5a53c0c4ae3708959d9465ea43ad5d90542 before f6add0a6f78dc6360b822ca4b6f9f2f14174c8ca; from 5160a5a53c0c4ae3708959d9465ea43ad5d90542 before ce0e99cae00e3131872936713b7f55eefd53ab86; 5160a5a53c0c4ae3708959d9465ea43ad5d90542 builds before 488dc6808cb8369685f18cee81e88e7052ac153b; from 5160a5a53c0c4ae3708959d9465ea43ad5d90542 before beaa51b36012fad5a4d3c18b88a617aea7a9b96d	CNA record
Siemens RUGGEDCOM RST2428P siemens:ruggedcom_rst2428p (from the name)	before V3.1	CISA ADP
Siemens SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family siemens:scalance_xc_300_xr_300_xc_400_xr_500wg_xr_500_family (from the name)	all versions not affected	CISA ADP
Siemens SCALANCE XCM-/XRM-/XCH-/XRH-300 family siemens:scalance_xcm_xrm_xch_xrh_300_family (from the name)	before V3.1	CISA ADP
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem siemens:simatic_s7_1500_tm_mfp_gnu_linux_subsystem (from the name)	before V1.1.1	CISA ADP
linux linux_kernel linux:linux_kernel	from 5.10 before 5.10.217; from 5.11 before 5.15.159; from 5.16 before 6.1.91; from 6.2 before 6.6.31; from 6.7 before 6.8.10; 6.9; 6.9; 6.9	NVD
debian debian_linux debian:debian_linux	10.0	NVD

References

References

https://git.kernel.org/stable/c/62accf6c1d7b433752cb3591bba8967b7a801ad5	patch
https://git.kernel.org/stable/c/844fc023e9f14a4fb1de5ae1eaefafd6d69c5fa1	patch
https://git.kernel.org/stable/c/f6add0a6f78dc6360b822ca4b6f9f2f14174c8ca	patch
https://git.kernel.org/stable/c/ce0e99cae00e3131872936713b7f55eefd53ab86	patch
https://git.kernel.org/stable/c/488dc6808cb8369685f18cee81e88e7052ac153b	patch
https://git.kernel.org/stable/c/beaa51b36012fad5a4d3c18b88a617aea7a9b96d	patch
https://lists.debian.org/debian-lts-announce/2024/06/msg00019.html	third-party-advisory
https://security.netapp.com/advisory/ntap-20240905-0006/	third-party-advisory
https://cert-portal.siemens.com/productcert/html/ssa-265688.html
https://cert-portal.siemens.com/productcert/html/ssa-613116.html

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.