CVE-2024-36031

CRITICAL
Published May 30, 2024 Modified Nov 4, 2025 CWE-324

Description

In the Linux kernel, the following vulnerability has been resolved: keys: Fix overwrite of key expiration on instantiation The expiry time of a key is unconditionally overwritten during instantiation, defaulting to turn it permanent. This causes a problem for DNS resolution as the expiration set by user-space is overwritten to TIME64_MAX, disabling further DNS updates. Fix this by restoring the condition that key_set_expiry is only called when the pre-parser sets a specific expiry.

Is your site exposed to CVE-2024-36031?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

9.8
CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness Type (CWE)

CWE-324 CWE-324

Affected Products

Vendor Product
linux linux_kernel
linux linux_kernel
linux linux_kernel
linux linux_kernel
linux linux_kernel
linux linux_kernel

References

Advisories & Patches

https://git.kernel.org/stable/c/25777f3f4e1f371d16a594925f31e37ce07b6ec7 https://git.kernel.org/stable/c/939a08bcd4334bad4b201e60bd0ae1f278d71d41 https://git.kernel.org/stable/c/9da27fb65a14c18efd4473e2e82b76b53ba60252 https://git.kernel.org/stable/c/ad2011ea787928b2accb5134f1e423b11fe80a8a https://git.kernel.org/stable/c/cc219cb8afbc40ec100c0de941047bb29373126a https://git.kernel.org/stable/c/e4519a016650e952ad9eb27937f8c447d5a4e06d https://git.kernel.org/stable/c/ed79b93f725cd0da39a265dc23d77add1527b9be https://git.kernel.org/stable/c/25777f3f4e1f371d16a594925f31e37ce07b6ec7 https://git.kernel.org/stable/c/939a08bcd4334bad4b201e60bd0ae1f278d71d41 https://git.kernel.org/stable/c/9da27fb65a14c18efd4473e2e82b76b53ba60252 https://git.kernel.org/stable/c/ad2011ea787928b2accb5134f1e423b11fe80a8a https://git.kernel.org/stable/c/cc219cb8afbc40ec100c0de941047bb29373126a https://git.kernel.org/stable/c/e4519a016650e952ad9eb27937f8c447d5a4e06d https://git.kernel.org/stable/c/ed79b93f725cd0da39a265dc23d77add1527b9be

Frequently Asked Questions

What is CVE-2024-36031? +
In the Linux kernel, the following vulnerability has been resolved: keys: Fix overwrite of key expiration on instantiation The expiry time of a key is unconditionally overwritten during instantiation, defaulting to turn it permanent. This causes a problem for DNS resolution as the expiration set by user-space is overwritten to TIME64_MAX, disabling further DNS updates. Fix this by restoring the condition that key_set_expiry is only called when the pre-parser sets a specific expiry. It has a CVSS v3.1 base score of 9.8 (CRITICAL).
How severe is CVE-2024-36031? +
CVE-2024-36031 has a CVSS v3.1 score of 9.8 out of 10, rated CRITICAL. This is a critical vulnerability that should be patched immediately.
What products are affected by CVE-2024-36031? +
CVE-2024-36031 affects products from linux, specifically: linux_kernel. Check the affected products table above for specific version ranges.
How do I check if I'm vulnerable to CVE-2024-36031? +
You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2025-31123 8.7

Zitadel is open-source identity infrastructure software. A vulnerability existed where expired keys can be used to retrieve tokens. Specifically, ZITADEL …
CVE-2026-39923 8.1

Flarum before 1.8.16 contains a password reset token expiry bypass vulnerability that allows unauthenticated attackers to reuse expired password reset …
CVE-2025-2291 8.1

Password can be used past expiry in PgBouncer due to auth_query not taking into account Postgres its VALID UNTIL value, …
CVE-2026-52809 6.8

Gogs is an open source self-hosted Git service. Prior to 0.14.3, password-reset tokens are generated using conf.Auth.ActivateCodeLives (the account-activation lifetime), …
CVE-2024-25679 6.5

In PQUIC before 5bde5bb, retention of unused initial encryption keys allows attackers to disrupt a connection with a PSK configuration …
CVE-2025-48813 6.3

Use of a key past its expiration date in Virtual Secure Mode allows an authorized attacker to perform spoofing locally.

Don't wait for an exploit

Scan your website for vulnerabilities like CVE-2024-36031 — free, no signup required.