CVE-2024-40911 (GCVE-0-2024-40911)

Vulnerability from cvelistv5 – Published: 2024-07-12 12:20 – Updated: 2026-08-05 11:33
VLAI
Title
wifi: cfg80211: Lock wiphy in cfg80211_get_station
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: Lock wiphy in cfg80211_get_station Wiphy should be locked before calling rdev_get_station() (see lockdep assert in ieee80211_get_station()). This fixes the following kernel NULL dereference: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000050 Mem abort info: ESR = 0x0000000096000006 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x06: level 2 translation fault Data abort info: ISV = 0, ISS = 0x00000006 CM = 0, WnR = 0 user pgtable: 4k pages, 48-bit VAs, pgdp=0000000003001000 [0000000000000050] pgd=0800000002dca003, p4d=0800000002dca003, pud=08000000028e9003, pmd=0000000000000000 Internal error: Oops: 0000000096000006 [#1] SMP Modules linked in: netconsole dwc3_meson_g12a dwc3_of_simple dwc3 ip_gre gre ath10k_pci ath10k_core ath9k ath9k_common ath9k_hw ath CPU: 0 PID: 1091 Comm: kworker/u8:0 Not tainted 6.4.0-02144-g565f9a3a7911-dirty #705 Hardware name: RPT (r1) (DT) Workqueue: bat_events batadv_v_elp_throughput_metric_update pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : ath10k_sta_statistics+0x10/0x2dc [ath10k_core] lr : sta_set_sinfo+0xcc/0xbd4 sp : ffff000007b43ad0 x29: ffff000007b43ad0 x28: ffff0000071fa900 x27: ffff00000294ca98 x26: ffff000006830880 x25: ffff000006830880 x24: ffff00000294c000 x23: 0000000000000001 x22: ffff000007b43c90 x21: ffff800008898acc x20: ffff00000294c6e8 x19: ffff000007b43c90 x18: 0000000000000000 x17: 445946354d552d78 x16: 62661f7200000000 x15: 57464f445946354d x14: 0000000000000000 x13: 00000000000000e3 x12: d5f0acbcebea978e x11: 00000000000000e3 x10: 000000010048fe41 x9 : 0000000000000000 x8 : ffff000007b43d90 x7 : 000000007a1e2125 x6 : 0000000000000000 x5 : ffff0000024e0900 x4 : ffff800000a0250c x3 : ffff000007b43c90 x2 : ffff00000294ca98 x1 : ffff000006831920 x0 : 0000000000000000 Call trace: ath10k_sta_statistics+0x10/0x2dc [ath10k_core] sta_set_sinfo+0xcc/0xbd4 ieee80211_get_station+0x2c/0x44 cfg80211_get_station+0x80/0x154 batadv_v_elp_get_throughput+0x138/0x1fc batadv_v_elp_throughput_metric_update+0x1c/0xa4 process_one_work+0x1ec/0x414 worker_thread+0x70/0x46c kthread+0xdc/0xe0 ret_from_fork+0x10/0x20 Code: a9bb7bfd 910003fd a90153f3 f9411c40 (f9402814) This happens because STA has time to disconnect and reconnect before batadv_v_elp_throughput_metric_update() delayed work gets scheduled. In this situation, ath10k_sta_state() can be in the middle of resetting arsta data when the work queue get chance to be scheduled and ends up accessing it. Locking wiphy prevents that.
Severity
8.8 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 7406353d43c8e2faf478721e87aeb6f2f9685de0 , < dfd84ce41663be9ca3f69bd657c45f49b69344d9 (git)
Affected: 7406353d43c8e2faf478721e87aeb6f2f9685de0 , < 6d540b0317901535275020bd4ac44fac6439ca76 (git)
Affected: 7406353d43c8e2faf478721e87aeb6f2f9685de0 , < 0ccc63958d8373e15a69f4f8069f3e78f7f3898a (git)
Affected: 7406353d43c8e2faf478721e87aeb6f2f9685de0 , < 43e1eefb0b2094e2281150d87d09e8bc872b9fba (git)
Affected: 7406353d43c8e2faf478721e87aeb6f2f9685de0 , < 642f89daa34567d02f312d03e41523a894906dae (git)
Create a notification for this product.
Linux Linux Affected: 3.16
Unaffected: 0 , < 3.16 (semver)
Unaffected: 5.15.162 , ≤ 5.15.* (semver)
Unaffected: 6.1.95 , ≤ 6.1.* (semver)
Unaffected: 6.6.35 , ≤ 6.6.* (semver)
Unaffected: 6.9.6 , ≤ 6.9.* (semver)
Unaffected: 6.10 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T21:57:40.593Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/dfd84ce41663be9ca3f69bd657c45f49b69344d9"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/6d540b0317901535275020bd4ac44fac6439ca76"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/0ccc63958d8373e15a69f4f8069f3e78f7f3898a"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/43e1eefb0b2094e2281150d87d09e8bc872b9fba"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/642f89daa34567d02f312d03e41523a894906dae"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-40911",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T17:06:02.658686Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:34:37.167Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/wireless/util.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "dfd84ce41663be9ca3f69bd657c45f49b69344d9",
              "status": "affected",
              "version": "7406353d43c8e2faf478721e87aeb6f2f9685de0",
              "versionType": "git"
            },
            {
              "lessThan": "6d540b0317901535275020bd4ac44fac6439ca76",
              "status": "affected",
              "version": "7406353d43c8e2faf478721e87aeb6f2f9685de0",
              "versionType": "git"
            },
            {
              "lessThan": "0ccc63958d8373e15a69f4f8069f3e78f7f3898a",
              "status": "affected",
              "version": "7406353d43c8e2faf478721e87aeb6f2f9685de0",
              "versionType": "git"
            },
            {
              "lessThan": "43e1eefb0b2094e2281150d87d09e8bc872b9fba",
              "status": "affected",
              "version": "7406353d43c8e2faf478721e87aeb6f2f9685de0",
              "versionType": "git"
            },
            {
              "lessThan": "642f89daa34567d02f312d03e41523a894906dae",
              "status": "affected",
              "version": "7406353d43c8e2faf478721e87aeb6f2f9685de0",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/wireless/util.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.16"
            },
            {
              "lessThan": "3.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.162",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.95",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.10",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.162",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.95",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.35",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9.6",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: Lock wiphy in cfg80211_get_station\n\nWiphy should be locked before calling rdev_get_station() (see lockdep\nassert in ieee80211_get_station()).\n\nThis fixes the following kernel NULL dereference:\n\n Unable to handle kernel NULL pointer dereference at virtual address 0000000000000050\n Mem abort info:\n   ESR = 0x0000000096000006\n   EC = 0x25: DABT (current EL), IL = 32 bits\n   SET = 0, FnV = 0\n   EA = 0, S1PTW = 0\n   FSC = 0x06: level 2 translation fault\n Data abort info:\n   ISV = 0, ISS = 0x00000006\n   CM = 0, WnR = 0\n user pgtable: 4k pages, 48-bit VAs, pgdp=0000000003001000\n [0000000000000050] pgd=0800000002dca003, p4d=0800000002dca003, pud=08000000028e9003, pmd=0000000000000000\n Internal error: Oops: 0000000096000006 [#1] SMP\n Modules linked in: netconsole dwc3_meson_g12a dwc3_of_simple dwc3 ip_gre gre ath10k_pci ath10k_core ath9k ath9k_common ath9k_hw ath\n CPU: 0 PID: 1091 Comm: kworker/u8:0 Not tainted 6.4.0-02144-g565f9a3a7911-dirty #705\n Hardware name: RPT (r1) (DT)\n Workqueue: bat_events batadv_v_elp_throughput_metric_update\n pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n pc : ath10k_sta_statistics+0x10/0x2dc [ath10k_core]\n lr : sta_set_sinfo+0xcc/0xbd4\n sp : ffff000007b43ad0\n x29: ffff000007b43ad0 x28: ffff0000071fa900 x27: ffff00000294ca98\n x26: ffff000006830880 x25: ffff000006830880 x24: ffff00000294c000\n x23: 0000000000000001 x22: ffff000007b43c90 x21: ffff800008898acc\n x20: ffff00000294c6e8 x19: ffff000007b43c90 x18: 0000000000000000\n x17: 445946354d552d78 x16: 62661f7200000000 x15: 57464f445946354d\n x14: 0000000000000000 x13: 00000000000000e3 x12: d5f0acbcebea978e\n x11: 00000000000000e3 x10: 000000010048fe41 x9 : 0000000000000000\n x8 : ffff000007b43d90 x7 : 000000007a1e2125 x6 : 0000000000000000\n x5 : ffff0000024e0900 x4 : ffff800000a0250c x3 : ffff000007b43c90\n x2 : ffff00000294ca98 x1 : ffff000006831920 x0 : 0000000000000000\n Call trace:\n  ath10k_sta_statistics+0x10/0x2dc [ath10k_core]\n  sta_set_sinfo+0xcc/0xbd4\n  ieee80211_get_station+0x2c/0x44\n  cfg80211_get_station+0x80/0x154\n  batadv_v_elp_get_throughput+0x138/0x1fc\n  batadv_v_elp_throughput_metric_update+0x1c/0xa4\n  process_one_work+0x1ec/0x414\n  worker_thread+0x70/0x46c\n  kthread+0xdc/0xe0\n  ret_from_fork+0x10/0x20\n Code: a9bb7bfd 910003fd a90153f3 f9411c40 (f9402814)\n\nThis happens because STA has time to disconnect and reconnect before\nbatadv_v_elp_throughput_metric_update() delayed work gets scheduled. In\nthis situation, ath10k_sta_state() can be in the middle of resetting\narsta data when the work queue get chance to be scheduled and ends up\naccessing it. Locking wiphy prevents that."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The vulnerable path is only reachable via batman-adv\u0027s ELP throughput worker querying a WiFi neighbour, and the race window is opened by that neighbour\u0027s 802.11 disassociation/reassociation. This requires the attacker to be a link-layer WiFi peer of the mesh node, i.e. within radio range on the same segment.\nAC:L - The attacker directly controls one side of the race by repeatedly disconnecting and reconnecting, which is precisely what triggers ath10k_sta_state()\u0027s memset(arsta) / sta_info teardown, while the ELP metric worker fires on a fixed ~500ms interval per neighbour and can be hit by simple repetition. The commit message confirms the race occurs even in ordinary operation without any attacker effort.\nPR:N - The attacker is a WiFi peer with no privileges or account on the victim mesh node, and batman-adv\u0027s typical deployments (community mesh, IBSS/802.11s links) are frequently unauthenticated/open. Being an ELP neighbour confers no privilege on the vulnerable system itself.\nUI:N - The batman-adv ELP worker polls neighbour throughput automatically on a timer with no operator involvement. The attacker only has to associate and drop the link.\nS:U - The corruption and crash occur entirely within the kernel of the affected mesh node, with no crossing of a virtualization, IOMMU, or sandbox boundary. Impact stays within the same security authority.\nC:H - Because neither the wiphy mutex nor an RCU read section is held, sta_info_get_bss() hands back a pointer that __sta_info_destroy_part2()/sta_info_free() can kfree() concurrently, so sta_set_sinfo() and the driver sta_statistics callback read a freed struct sta_info and chase its embedded pointers. A use-after-free read of a heap object whose contents the attacker can groom by reassociating yields an arbitrary-read primitive.\nI:H - The same use-after-free lets the attacker control the reallocated object\u0027s contents, and the driver callback dereferences pointers taken from it (e.g. arsta-\u003earvif-\u003ear and driver ops), giving a corruption/control-flow primitive. Per kernel scoring guidance, use-after-free and type-confusion of a freed structure are treated as High integrity impact.\nA:H - The reported and reproducible outcome is a kernel NULL pointer dereference oops in ath10k_sta_statistics(), panicking the mesh node. The attacker can retrigger it at will by cycling association, giving persistent denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:33:58.834Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/dfd84ce41663be9ca3f69bd657c45f49b69344d9"
        },
        {
          "url": "https://git.kernel.org/stable/c/6d540b0317901535275020bd4ac44fac6439ca76"
        },
        {
          "url": "https://git.kernel.org/stable/c/0ccc63958d8373e15a69f4f8069f3e78f7f3898a"
        },
        {
          "url": "https://git.kernel.org/stable/c/43e1eefb0b2094e2281150d87d09e8bc872b9fba"
        },
        {
          "url": "https://git.kernel.org/stable/c/642f89daa34567d02f312d03e41523a894906dae"
        }
      ],
      "title": "wifi: cfg80211: Lock wiphy in cfg80211_get_station",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-40911",
    "datePublished": "2024-07-12T12:20:49.796Z",
    "dateReserved": "2024-07-12T12:17:45.580Z",
    "dateUpdated": "2026-08-05T11:33:58.834Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-40911",
      "date": "2026-08-05",
      "epss": "0.00408",
      "percentile": "0.33492"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"3.16\", \"versionEndExcluding\": \"5.15.162\", \"matchCriteriaId\": \"1383491E-908E-4536-BB15-D4B4B08F8358\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.16\", \"versionEndExcluding\": \"6.1.95\", \"matchCriteriaId\": \"D435765D-2766-44F5-B319-F713A13E35CE\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.2\", \"versionEndExcluding\": \"6.6.35\", \"matchCriteriaId\": \"6F019D15-84C0-416B-8C57-7F51B68992F0\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.7\", \"versionEndExcluding\": \"6.9.6\", \"matchCriteriaId\": \"0ABBBA1D-F79D-4BDB-AA41-D1EDCC4A6975\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.10:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"2EBB4392-5FA6-4DA9-9772-8F9C750109FA\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.10:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"331C2F14-12C7-45D5-893D-8C52EE38EA10\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: cfg80211: Lock wiphy in cfg80211_get_station\\n\\nWiphy should be locked before calling rdev_get_station() (see lockdep\\nassert in ieee80211_get_station()).\\n\\nThis fixes the following kernel NULL dereference:\\n\\n Unable to handle kernel NULL pointer dereference at virtual address 0000000000000050\\n Mem abort info:\\n   ESR = 0x0000000096000006\\n   EC = 0x25: DABT (current EL), IL = 32 bits\\n   SET = 0, FnV = 0\\n   EA = 0, S1PTW = 0\\n   FSC = 0x06: level 2 translation fault\\n Data abort info:\\n   ISV = 0, ISS = 0x00000006\\n   CM = 0, WnR = 0\\n user pgtable: 4k pages, 48-bit VAs, pgdp=0000000003001000\\n [0000000000000050] pgd=0800000002dca003, p4d=0800000002dca003, pud=08000000028e9003, pmd=0000000000000000\\n Internal error: Oops: 0000000096000006 [#1] SMP\\n Modules linked in: netconsole dwc3_meson_g12a dwc3_of_simple dwc3 ip_gre gre ath10k_pci ath10k_core ath9k ath9k_common ath9k_hw ath\\n CPU: 0 PID: 1091 Comm: kworker/u8:0 Not tainted 6.4.0-02144-g565f9a3a7911-dirty #705\\n Hardware name: RPT (r1) (DT)\\n Workqueue: bat_events batadv_v_elp_throughput_metric_update\\n pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\\n pc : ath10k_sta_statistics+0x10/0x2dc [ath10k_core]\\n lr : sta_set_sinfo+0xcc/0xbd4\\n sp : ffff000007b43ad0\\n x29: ffff000007b43ad0 x28: ffff0000071fa900 x27: ffff00000294ca98\\n x26: ffff000006830880 x25: ffff000006830880 x24: ffff00000294c000\\n x23: 0000000000000001 x22: ffff000007b43c90 x21: ffff800008898acc\\n x20: ffff00000294c6e8 x19: ffff000007b43c90 x18: 0000000000000000\\n x17: 445946354d552d78 x16: 62661f7200000000 x15: 57464f445946354d\\n x14: 0000000000000000 x13: 00000000000000e3 x12: d5f0acbcebea978e\\n x11: 00000000000000e3 x10: 000000010048fe41 x9 : 0000000000000000\\n x8 : ffff000007b43d90 x7 : 000000007a1e2125 x6 : 0000000000000000\\n x5 : ffff0000024e0900 x4 : ffff800000a0250c x3 : ffff000007b43c90\\n x2 : ffff00000294ca98 x1 : ffff000006831920 x0 : 0000000000000000\\n Call trace:\\n  ath10k_sta_statistics+0x10/0x2dc [ath10k_core]\\n  sta_set_sinfo+0xcc/0xbd4\\n  ieee80211_get_station+0x2c/0x44\\n  cfg80211_get_station+0x80/0x154\\n  batadv_v_elp_get_throughput+0x138/0x1fc\\n  batadv_v_elp_throughput_metric_update+0x1c/0xa4\\n  process_one_work+0x1ec/0x414\\n  worker_thread+0x70/0x46c\\n  kthread+0xdc/0xe0\\n  ret_from_fork+0x10/0x20\\n Code: a9bb7bfd 910003fd a90153f3 f9411c40 (f9402814)\\n\\nThis happens because STA has time to disconnect and reconnect before\\nbatadv_v_elp_throughput_metric_update() delayed work gets scheduled. In\\nthis situation, ath10k_sta_state() can be in the middle of resetting\\narsta data when the work queue get chance to be scheduled and ends up\\naccessing it. Locking wiphy prevents that.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: wifi: cfg80211: bloquear wiphy en cfg80211_get_station Wiphy debe estar bloqueado antes de llamar a rdev_get_station() (ver lockdep afirmar en ieee80211_get_station()). Esto corrige la siguiente desreferencia NULL del kernel: No se puede manejar la desreferencia del puntero NULL del kernel en la direcci\\u00f3n virtual 0000000000000050 Informaci\\u00f3n de cancelaci\\u00f3n de memoria: ESR = 0x0000000096000006 EC = 0x25: DABT (EL actual), IL = 32 bits SET = 0, FnV = 0 EA = 0 , S1PTW = 0 FSC = 0x06: error de traducci\\u00f3n de nivel 2 Informaci\\u00f3n de cancelaci\\u00f3n de datos: ISV = 0, ISS = 0x00000006 CM = 0, WnR = 0 tabla de p\\u00e1ginas de usuario: 4k p\\u00e1ginas, VA de 48 bits, pgdp=0000000003001000 [0000000000000050] 00000002dca003 , p4d=0800000002dca003, pud=08000000028e9003, pmd=0000000000000000 Error interno: Ups: 0000000096000006 [#1] M\\u00f3dulos SMP vinculados en: netconsole dwc3_meson_g12a dwc3_of_simple dwc 3 ip_gre gre ath10k_pci ath10k_core ath9k ath9k_common ath9k_hw ath CPU: 0 PID: 1091 Comunicaciones: kworker/u8 :0 No contaminado 6.4.0-02144-g565f9a3a7911-dirty #705 Nombre de hardware: RPT (r1) (DT) Cola de trabajo: bat_events batadv_v_elp_throughput_metric_update pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc: ath10k_sta_statistics+0x10/0x2dc [ath10k_core] lr: sta_set_sinfo+0xcc/0xbd4 sp: ffff000007b43ad0 x29: ffff000007b43ad0 x28: ffff0000071fa900 x27: ffff00000294ca98 6: ffff000006830880 x25: ffff000006830880 x24: ffff00000294c000 x23: 0000000000000001 x22: ffff000007b43c90 x21: ffff800008898acc x20: 0294c6e8 x19: ffff000007b43c90 x18: 0000000000000000 x17: 445946354d552d78 x16: 62661f7200000000 x15: 57464f445946354d x14: 000000000000000 0 x13: 00000000000000e3 x12: d5f0acbcebea978e x11: 00000000000000e3 x10: 000000010048fe41 x9: 0000000000000000 x8: ffff000007b43d90 x7: 00 0000007a1e2125 x6: 0000000000000000 x5: ffff0000024e0900 x4: ffff800000a0250c x3: ffff000007b43c90 x2: ffff00000294ca98 x1: ffff000006831920 x0: 0000000000000000 Rastreo de llamadas: ath10k_sta_statistics+0x10/0x2dc [ath10k_core] sta_set_sinfo+0xcc/0xbd4 0211_get_station+0x2c/0x44 cfg80211_get_station+0x80/0x154 batadv_v_elp_get_throughput+0x138/0x1fc batadv_v_elp_throughput_metric_update+0x1c/0xa4 Process_one_work+0x1ec/ 0x414 work_thread+0x70/0x46c kthread+0xdc/0xe0 ret_from_fork+0x10/0x20 C\\u00f3digo: a9bb7bfd 910003fd a90153f3 f9411c40 (f9402814) Esto sucede porque STA tiene tiempo para desconectarse y volver a conectarse antes de batadv_v_elp_throughput_metric_up date() se programa el trabajo retrasado. En esta situaci\\u00f3n, ath10k_sta_state() puede estar en medio de restablecer los datos de arsta cuando la cola de trabajo tiene la oportunidad de programarse y termina accediendo a ella. Bloquear Wiphy evita eso.\"}]",
      "id": "CVE-2024-40911",
      "lastModified": "2024-11-21T09:31:50.547",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 3.6}]}",
      "published": "2024-07-12T13:15:14.283",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/0ccc63958d8373e15a69f4f8069f3e78f7f3898a\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/43e1eefb0b2094e2281150d87d09e8bc872b9fba\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/642f89daa34567d02f312d03e41523a894906dae\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/6d540b0317901535275020bd4ac44fac6439ca76\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/dfd84ce41663be9ca3f69bd657c45f49b69344d9\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/0ccc63958d8373e15a69f4f8069f3e78f7f3898a\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/43e1eefb0b2094e2281150d87d09e8bc872b9fba\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/642f89daa34567d02f312d03e41523a894906dae\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/6d540b0317901535275020bd4ac44fac6439ca76\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/dfd84ce41663be9ca3f69bd657c45f49b69344d9\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-476\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-40911\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-07-12T13:15:14.283\",\"lastModified\":\"2026-08-04T11:19:04.683\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: cfg80211: Lock wiphy in cfg80211_get_station\\n\\nWiphy should be locked before calling rdev_get_station() (see lockdep\\nassert in ieee80211_get_station()).\\n\\nThis fixes the following kernel NULL dereference:\\n\\n Unable to handle kernel NULL pointer dereference at virtual address 0000000000000050\\n Mem abort info:\\n   ESR = 0x0000000096000006\\n   EC = 0x25: DABT (current EL), IL = 32 bits\\n   SET = 0, FnV = 0\\n   EA = 0, S1PTW = 0\\n   FSC = 0x06: level 2 translation fault\\n Data abort info:\\n   ISV = 0, ISS = 0x00000006\\n   CM = 0, WnR = 0\\n user pgtable: 4k pages, 48-bit VAs, pgdp=0000000003001000\\n [0000000000000050] pgd=0800000002dca003, p4d=0800000002dca003, pud=08000000028e9003, pmd=0000000000000000\\n Internal error: Oops: 0000000096000006 [#1] SMP\\n Modules linked in: netconsole dwc3_meson_g12a dwc3_of_simple dwc3 ip_gre gre ath10k_pci ath10k_core ath9k ath9k_common ath9k_hw ath\\n CPU: 0 PID: 1091 Comm: kworker/u8:0 Not tainted 6.4.0-02144-g565f9a3a7911-dirty #705\\n Hardware name: RPT (r1) (DT)\\n Workqueue: bat_events batadv_v_elp_throughput_metric_update\\n pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\\n pc : ath10k_sta_statistics+0x10/0x2dc [ath10k_core]\\n lr : sta_set_sinfo+0xcc/0xbd4\\n sp : ffff000007b43ad0\\n x29: ffff000007b43ad0 x28: ffff0000071fa900 x27: ffff00000294ca98\\n x26: ffff000006830880 x25: ffff000006830880 x24: ffff00000294c000\\n x23: 0000000000000001 x22: ffff000007b43c90 x21: ffff800008898acc\\n x20: ffff00000294c6e8 x19: ffff000007b43c90 x18: 0000000000000000\\n x17: 445946354d552d78 x16: 62661f7200000000 x15: 57464f445946354d\\n x14: 0000000000000000 x13: 00000000000000e3 x12: d5f0acbcebea978e\\n x11: 00000000000000e3 x10: 000000010048fe41 x9 : 0000000000000000\\n x8 : ffff000007b43d90 x7 : 000000007a1e2125 x6 : 0000000000000000\\n x5 : ffff0000024e0900 x4 : ffff800000a0250c x3 : ffff000007b43c90\\n x2 : ffff00000294ca98 x1 : ffff000006831920 x0 : 0000000000000000\\n Call trace:\\n  ath10k_sta_statistics+0x10/0x2dc [ath10k_core]\\n  sta_set_sinfo+0xcc/0xbd4\\n  ieee80211_get_station+0x2c/0x44\\n  cfg80211_get_station+0x80/0x154\\n  batadv_v_elp_get_throughput+0x138/0x1fc\\n  batadv_v_elp_throughput_metric_update+0x1c/0xa4\\n  process_one_work+0x1ec/0x414\\n  worker_thread+0x70/0x46c\\n  kthread+0xdc/0xe0\\n  ret_from_fork+0x10/0x20\\n Code: a9bb7bfd 910003fd a90153f3 f9411c40 (f9402814)\\n\\nThis happens because STA has time to disconnect and reconnect before\\nbatadv_v_elp_throughput_metric_update() delayed work gets scheduled. In\\nthis situation, ath10k_sta_state() can be in the middle of resetting\\narsta data when the work queue get chance to be scheduled and ends up\\naccessing it. Locking wiphy prevents that.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: wifi: cfg80211: bloquear wiphy en cfg80211_get_station Wiphy debe estar bloqueado antes de llamar a rdev_get_station() (ver lockdep afirmar en ieee80211_get_station()). Esto corrige la siguiente desreferencia NULL del kernel: No se puede manejar la desreferencia del puntero NULL del kernel en la direcci\u00f3n virtual 0000000000000050 Informaci\u00f3n de cancelaci\u00f3n de memoria: ESR = 0x0000000096000006 EC = 0x25: DABT (EL actual), IL = 32 bits SET = 0, FnV = 0 EA = 0 , S1PTW = 0 FSC = 0x06: error de traducci\u00f3n de nivel 2 Informaci\u00f3n de cancelaci\u00f3n de datos: ISV = 0, ISS = 0x00000006 CM = 0, WnR = 0 tabla de p\u00e1ginas de usuario: 4k p\u00e1ginas, VA de 48 bits, pgdp=0000000003001000 [0000000000000050] 00000002dca003 , p4d=0800000002dca003, pud=08000000028e9003, pmd=0000000000000000 Error interno: Ups: 0000000096000006 [#1] M\u00f3dulos SMP vinculados en: netconsole dwc3_meson_g12a dwc3_of_simple dwc 3 ip_gre gre ath10k_pci ath10k_core ath9k ath9k_common ath9k_hw ath CPU: 0 PID: 1091 Comunicaciones: kworker/u8 :0 No contaminado 6.4.0-02144-g565f9a3a7911-dirty #705 Nombre de hardware: RPT (r1) (DT) Cola de trabajo: bat_events batadv_v_elp_throughput_metric_update pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc: ath10k_sta_statistics+0x10/0x2dc [ath10k_core] lr: sta_set_sinfo+0xcc/0xbd4 sp: ffff000007b43ad0 x29: ffff000007b43ad0 x28: ffff0000071fa900 x27: ffff00000294ca98 6: ffff000006830880 x25: ffff000006830880 x24: ffff00000294c000 x23: 0000000000000001 x22: ffff000007b43c90 x21: ffff800008898acc x20: 0294c6e8 x19: ffff000007b43c90 x18: 0000000000000000 x17: 445946354d552d78 x16: 62661f7200000000 x15: 57464f445946354d x14: 000000000000000 0 x13: 00000000000000e3 x12: d5f0acbcebea978e x11: 00000000000000e3 x10: 000000010048fe41 x9: 0000000000000000 x8: ffff000007b43d90 x7: 00 0000007a1e2125 x6: 0000000000000000 x5: ffff0000024e0900 x4: ffff800000a0250c x3: ffff000007b43c90 x2: ffff00000294ca98 x1: ffff000006831920 x0: 0000000000000000 Rastreo de llamadas: ath10k_sta_statistics+0x10/0x2dc [ath10k_core] sta_set_sinfo+0xcc/0xbd4 0211_get_station+0x2c/0x44 cfg80211_get_station+0x80/0x154 batadv_v_elp_get_throughput+0x138/0x1fc batadv_v_elp_throughput_metric_update+0x1c/0xa4 Process_one_work+0x1ec/ 0x414 work_thread+0x70/0x46c kthread+0xdc/0xe0 ret_from_fork+0x10/0x20 C\u00f3digo: a9bb7bfd 910003fd a90153f3 f9411c40 (f9402814) Esto sucede porque STA tiene tiempo para desconectarse y volver a conectarse antes de batadv_v_elp_throughput_metric_up date() se programa el trabajo retrasado. En esta situaci\u00f3n, ath10k_sta_state() puede estar en medio de restablecer los datos de arsta cuando la cola de trabajo tiene la oportunidad de programarse y termina accediendo a ella. Bloquear Wiphy evita eso.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/wireless/util.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"7406353d43c8e2faf478721e87aeb6f2f9685de0\",\"lessThan\":\"dfd84ce41663be9ca3f69bd657c45f49b69344d9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7406353d43c8e2faf478721e87aeb6f2f9685de0\",\"lessThan\":\"6d540b0317901535275020bd4ac44fac6439ca76\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7406353d43c8e2faf478721e87aeb6f2f9685de0\",\"lessThan\":\"0ccc63958d8373e15a69f4f8069f3e78f7f3898a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7406353d43c8e2faf478721e87aeb6f2f9685de0\",\"lessThan\":\"43e1eefb0b2094e2281150d87d09e8bc872b9fba\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7406353d43c8e2faf478721e87aeb6f2f9685de0\",\"lessThan\":\"642f89daa34567d02f312d03e41523a894906dae\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/wireless/util.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3.16\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"3.16\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.162\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.95\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.35\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.9.6\",\"lessThanOrEqual\":\"6.9.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-10T17:06:02.658686Z\",\"id\":\"CVE-2024-40911\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.16\",\"versionEndExcluding\":\"5.15.162\",\"matchCriteriaId\":\"1383491E-908E-4536-BB15-D4B4B08F8358\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.95\",\"matchCriteriaId\":\"D435765D-2766-44F5-B319-F713A13E35CE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.35\",\"matchCriteriaId\":\"6F019D15-84C0-416B-8C57-7F51B68992F0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.9.6\",\"matchCriteriaId\":\"0ABBBA1D-F79D-4BDB-AA41-D1EDCC4A6975\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.10:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"2EBB4392-5FA6-4DA9-9772-8F9C750109FA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.10:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"331C2F14-12C7-45D5-893D-8C52EE38EA10\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0ccc63958d8373e15a69f4f8069f3e78f7f3898a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/43e1eefb0b2094e2281150d87d09e8bc872b9fba\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/642f89daa34567d02f312d03e41523a894906dae\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6d540b0317901535275020bd4ac44fac6439ca76\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/dfd84ce41663be9ca3f69bd657c45f49b69344d9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/0ccc63958d8373e15a69f4f8069f3e78f7f3898a\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/43e1eefb0b2094e2281150d87d09e8bc872b9fba\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/642f89daa34567d02f312d03e41523a894906dae\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6d540b0317901535275020bd4ac44fac6439ca76\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/dfd84ce41663be9ca3f69bd657c45f49b69344d9\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T18:47:12+00:00",
      "cve": "CVE-2024-40911",
      "id": "CVE-2024-40911",
      "initial_release_date": "2024-07-12T00:00:00+00:00",
      "product_status:fixed": "429",
      "product_status:known_affected": "64",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: wifi: cfg80211: Lock wiphy in cfg80211_get_station",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-40911.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-23T02:03:56Z",
      "cve": "CVE-2024-40911",
      "id": "CVE-2024-40911",
      "initial_release_date": "2024-07-16T02:34:59Z",
      "product_status:known_affected": "560",
      "product_status:known_not_affected": "6",
      "product_status:recommended": "707",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-40911",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-40911.json",
      "version": "92"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/dfd84ce41663be9ca3f69bd657c45f49b69344d9\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/6d540b0317901535275020bd4ac44fac6439ca76\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/0ccc63958d8373e15a69f4f8069f3e78f7f3898a\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/43e1eefb0b2094e2281150d87d09e8bc872b9fba\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/642f89daa34567d02f312d03e41523a894906dae\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T21:57:40.593Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-40911\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T17:06:02.658686Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:24.837Z\"}}], \"cna\": {\"title\": \"wifi: cfg80211: Lock wiphy in cfg80211_get_station\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"7406353d43c8e2faf478721e87aeb6f2f9685de0\", \"lessThan\": \"dfd84ce41663be9ca3f69bd657c45f49b69344d9\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"7406353d43c8e2faf478721e87aeb6f2f9685de0\", \"lessThan\": \"6d540b0317901535275020bd4ac44fac6439ca76\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"7406353d43c8e2faf478721e87aeb6f2f9685de0\", \"lessThan\": \"0ccc63958d8373e15a69f4f8069f3e78f7f3898a\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"7406353d43c8e2faf478721e87aeb6f2f9685de0\", \"lessThan\": \"43e1eefb0b2094e2281150d87d09e8bc872b9fba\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"7406353d43c8e2faf478721e87aeb6f2f9685de0\", \"lessThan\": \"642f89daa34567d02f312d03e41523a894906dae\", \"versionType\": \"git\"}], \"programFiles\": [\"net/wireless/util.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"3.16\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"3.16\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.15.162\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.95\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.35\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9.6\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.9.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"net/wireless/util.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/dfd84ce41663be9ca3f69bd657c45f49b69344d9\"}, {\"url\": \"https://git.kernel.org/stable/c/6d540b0317901535275020bd4ac44fac6439ca76\"}, {\"url\": \"https://git.kernel.org/stable/c/0ccc63958d8373e15a69f4f8069f3e78f7f3898a\"}, {\"url\": \"https://git.kernel.org/stable/c/43e1eefb0b2094e2281150d87d09e8bc872b9fba\"}, {\"url\": \"https://git.kernel.org/stable/c/642f89daa34567d02f312d03e41523a894906dae\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: cfg80211: Lock wiphy in cfg80211_get_station\\n\\nWiphy should be locked before calling rdev_get_station() (see lockdep\\nassert in ieee80211_get_station()).\\n\\nThis fixes the following kernel NULL dereference:\\n\\n Unable to handle kernel NULL pointer dereference at virtual address 0000000000000050\\n Mem abort info:\\n   ESR = 0x0000000096000006\\n   EC = 0x25: DABT (current EL), IL = 32 bits\\n   SET = 0, FnV = 0\\n   EA = 0, S1PTW = 0\\n   FSC = 0x06: level 2 translation fault\\n Data abort info:\\n   ISV = 0, ISS = 0x00000006\\n   CM = 0, WnR = 0\\n user pgtable: 4k pages, 48-bit VAs, pgdp=0000000003001000\\n [0000000000000050] pgd=0800000002dca003, p4d=0800000002dca003, pud=08000000028e9003, pmd=0000000000000000\\n Internal error: Oops: 0000000096000006 [#1] SMP\\n Modules linked in: netconsole dwc3_meson_g12a dwc3_of_simple dwc3 ip_gre gre ath10k_pci ath10k_core ath9k ath9k_common ath9k_hw ath\\n CPU: 0 PID: 1091 Comm: kworker/u8:0 Not tainted 6.4.0-02144-g565f9a3a7911-dirty #705\\n Hardware name: RPT (r1) (DT)\\n Workqueue: bat_events batadv_v_elp_throughput_metric_update\\n pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\\n pc : ath10k_sta_statistics+0x10/0x2dc [ath10k_core]\\n lr : sta_set_sinfo+0xcc/0xbd4\\n sp : ffff000007b43ad0\\n x29: ffff000007b43ad0 x28: ffff0000071fa900 x27: ffff00000294ca98\\n x26: ffff000006830880 x25: ffff000006830880 x24: ffff00000294c000\\n x23: 0000000000000001 x22: ffff000007b43c90 x21: ffff800008898acc\\n x20: ffff00000294c6e8 x19: ffff000007b43c90 x18: 0000000000000000\\n x17: 445946354d552d78 x16: 62661f7200000000 x15: 57464f445946354d\\n x14: 0000000000000000 x13: 00000000000000e3 x12: d5f0acbcebea978e\\n x11: 00000000000000e3 x10: 000000010048fe41 x9 : 0000000000000000\\n x8 : ffff000007b43d90 x7 : 000000007a1e2125 x6 : 0000000000000000\\n x5 : ffff0000024e0900 x4 : ffff800000a0250c x3 : ffff000007b43c90\\n x2 : ffff00000294ca98 x1 : ffff000006831920 x0 : 0000000000000000\\n Call trace:\\n  ath10k_sta_statistics+0x10/0x2dc [ath10k_core]\\n  sta_set_sinfo+0xcc/0xbd4\\n  ieee80211_get_station+0x2c/0x44\\n  cfg80211_get_station+0x80/0x154\\n  batadv_v_elp_get_throughput+0x138/0x1fc\\n  batadv_v_elp_throughput_metric_update+0x1c/0xa4\\n  process_one_work+0x1ec/0x414\\n  worker_thread+0x70/0x46c\\n  kthread+0xdc/0xe0\\n  ret_from_fork+0x10/0x20\\n Code: a9bb7bfd 910003fd a90153f3 f9411c40 (f9402814)\\n\\nThis happens because STA has time to disconnect and reconnect before\\nbatadv_v_elp_throughput_metric_update() delayed work gets scheduled. In\\nthis situation, ath10k_sta_state() can be in the middle of resetting\\narsta data when the work queue get chance to be scheduled and ends up\\naccessing it. Locking wiphy prevents that.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.162\", \"versionStartIncluding\": \"3.16\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.95\", \"versionStartIncluding\": \"3.16\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.35\", \"versionStartIncluding\": \"3.16\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9.6\", \"versionStartIncluding\": \"3.16\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10\", \"versionStartIncluding\": \"3.16\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-11T20:22:12.729Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-40911\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-11T20:22:12.729Z\", \"dateReserved\": \"2024-07-12T12:17:45.580Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-07-12T12:20:49.796Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.