CVE-2024-40930 (GCVE-0-2024-40930)

Vulnerability from cvelistv5 – Published: 2024-07-12 12:25 – Updated: 2026-08-05 11:34
VLAI
Title
wifi: cfg80211: validate HE operation element parsing
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: validate HE operation element parsing Validate that the HE operation element has the correct length before parsing it.
Severity
7.1 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 645f3d85129d8aac3b896ba685fbc20a31c2c036 , < f15e3e13e14cc5ae8f950c16efe706add18ac8e2 (git)
Affected: 645f3d85129d8aac3b896ba685fbc20a31c2c036 , < 4dc3a3893dae5a7f73e5809273aca0f1f3548d55 (git)
Create a notification for this product.
Linux Linux Affected: 6.8
Unaffected: 0 , < 6.8 (semver)
Unaffected: 6.9.6 , ≤ 6.9.* (semver)
Unaffected: 6.10 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T04:39:55.787Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/f15e3e13e14cc5ae8f950c16efe706add18ac8e2"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/4dc3a3893dae5a7f73e5809273aca0f1f3548d55"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-40930",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T17:05:02.066310Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:33:02.818Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/wireless/scan.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f15e3e13e14cc5ae8f950c16efe706add18ac8e2",
              "status": "affected",
              "version": "645f3d85129d8aac3b896ba685fbc20a31c2c036",
              "versionType": "git"
            },
            {
              "lessThan": "4dc3a3893dae5a7f73e5809273aca0f1f3548d55",
              "status": "affected",
              "version": "645f3d85129d8aac3b896ba685fbc20a31c2c036",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/wireless/scan.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.10",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9.6",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: validate HE operation element parsing\n\nValidate that the HE operation element has the correct\nlength before parsing it."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The vulnerability is triggered by parsing the HE Operation element of a raw 802.11 beacon or probe response received over the air, requiring the attacker only to be within radio range on a 6 GHz channel. This is classic WiFi frame injection, which maps to Adjacent.\nAC:L - The attacker deterministically crafts a 7-byte HE Operation element with the 6GHZ_OP_INFO, VHT_OPER_INFO and CO_HOSTED_BSS bits set in he_oper_params, which unconditionally drives the read past the element end; there is no race and no unknown state to win. The victim merely needs a 6 GHz-capable radio performing a scan, which is automatic, routine behavior.\nPR:N - Beacons and 6 GHz broadcast probe responses are parsed during scanning with no authentication, association, or key exchange whatsoever \u2014 ieee80211_scan_rx() accepts them from any BSSID. The attacker needs no credentials or account on the target.\nUI:N - Background and connection-triggered scans run automatically on WiFi clients and APs, so the malicious frame is ingested with no victim action. The user never has to select or connect to the rogue AP.\nS:U - The out-of-bounds read stays within kernel memory managed by the same security authority as the vulnerable cfg80211 code. No VM, IOMMU, or sandbox boundary is crossed.\nC:L - A single byte is read up to five bytes past the end of the received frame buffer, and its REG_INFO bits steer the BSS use_for/cannot_use_reasons flags that cfg80211 exports to userspace via nl80211 \u2014 giving a repeatable few-bit oracle on adjacent kernel memory. The disclosure is real but strictly bounded to one byte at a fixed small offset, so Low rather than High.\nI:N - The bug is a pure read with no out-of-bounds write, no freed-object reuse, and no type confusion, so no attacker-controlled memory modification is possible. The only state it influences is a usability flag on a BSS whose contents the attacker already fully controls.\nA:H - This is a memory-safety violation reading beyond the frame buffer, which produces a KASAN report (a panic under panic_on_warn or kasan.fault=panic, and a trap under Android arm64 MTE) and can fault outright if the buffer ends at a page boundary. An unauthenticated attacker can replay the malformed beacon continuously, so any resulting oops is trivially repeatable."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:34:06.321Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f15e3e13e14cc5ae8f950c16efe706add18ac8e2"
        },
        {
          "url": "https://git.kernel.org/stable/c/4dc3a3893dae5a7f73e5809273aca0f1f3548d55"
        }
      ],
      "title": "wifi: cfg80211: validate HE operation element parsing",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-40930",
    "datePublished": "2024-07-12T12:25:09.110Z",
    "dateReserved": "2024-07-12T12:17:45.583Z",
    "dateUpdated": "2026-08-05T11:34:06.321Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-40930",
      "date": "2026-08-10",
      "epss": "0.00243",
      "percentile": "0.15442"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: cfg80211: validate HE operation element parsing\\n\\nValidate that the HE operation element has the correct\\nlength before parsing it.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux se ha resuelto la siguiente vulnerabilidad: wifi: cfg80211: validar an\\u00e1lisis del elemento de operaci\\u00f3n HE Validar que el elemento de operaci\\u00f3n HE tenga la longitud correcta antes de analizarlo.\"}]",
      "id": "CVE-2024-40930",
      "lastModified": "2024-11-21T09:31:53.580",
      "published": "2024-07-12T13:15:15.690",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/4dc3a3893dae5a7f73e5809273aca0f1f3548d55\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/f15e3e13e14cc5ae8f950c16efe706add18ac8e2\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/4dc3a3893dae5a7f73e5809273aca0f1f3548d55\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/f15e3e13e14cc5ae8f950c16efe706add18ac8e2\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-40930\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-07-12T13:15:15.690\",\"lastModified\":\"2026-08-04T11:19:06.890\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: cfg80211: validate HE operation element parsing\\n\\nValidate that the HE operation element has the correct\\nlength before parsing it.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux se ha resuelto la siguiente vulnerabilidad: wifi: cfg80211: validar an\u00e1lisis del elemento de operaci\u00f3n HE Validar que el elemento de operaci\u00f3n HE tenga la longitud correcta antes de analizarlo.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/wireless/scan.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"645f3d85129d8aac3b896ba685fbc20a31c2c036\",\"lessThan\":\"f15e3e13e14cc5ae8f950c16efe706add18ac8e2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"645f3d85129d8aac3b896ba685fbc20a31c2c036\",\"lessThan\":\"4dc3a3893dae5a7f73e5809273aca0f1f3548d55\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/wireless/scan.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.8\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.8\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.9.6\",\"lessThanOrEqual\":\"6.9.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":4.2},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-10T17:05:02.066310Z\",\"id\":\"CVE-2024-40930\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.8\",\"versionEndExcluding\":\"6.9.6\",\"matchCriteriaId\":\"5A16B675-D12F-49F9-AB96-23E6074FF336\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.10:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"2EBB4392-5FA6-4DA9-9772-8F9C750109FA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.10:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"331C2F14-12C7-45D5-893D-8C52EE38EA10\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/4dc3a3893dae5a7f73e5809273aca0f1f3548d55\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f15e3e13e14cc5ae8f950c16efe706add18ac8e2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4dc3a3893dae5a7f73e5809273aca0f1f3548d55\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f15e3e13e14cc5ae8f950c16efe706add18ac8e2\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T18:48:35+00:00",
      "cve": "CVE-2024-40930",
      "id": "CVE-2024-40930",
      "initial_release_date": "2024-07-12T00:00:00+00:00",
      "product_status:fixed": "280",
      "product_status:known_affected": "64",
      "product_status:known_not_affected": "56",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: wifi: cfg80211: validate HE operation element parsing",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-40930.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-05T00:56:06Z",
      "cve": "CVE-2024-40930",
      "id": "CVE-2024-40930",
      "initial_release_date": "2024-07-26T03:11:53Z",
      "product_status:known_affected": "394",
      "product_status:known_not_affected": "258",
      "product_status:recommended": "360",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-40930",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-40930.json",
      "version": "76"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/f15e3e13e14cc5ae8f950c16efe706add18ac8e2\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/4dc3a3893dae5a7f73e5809273aca0f1f3548d55\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T04:39:55.787Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-40930\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T17:05:02.066310Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:14.221Z\"}}], \"cna\": {\"title\": \"wifi: cfg80211: validate HE operation element parsing\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.1, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:A - The vulnerability is triggered by parsing the HE Operation element of a raw 802.11 beacon or probe response received over the air, requiring the attacker only to be within radio range on a 6 GHz channel. This is classic WiFi frame injection, which maps to Adjacent.\\nAC:L - The attacker deterministically crafts a 7-byte HE Operation element with the 6GHZ_OP_INFO, VHT_OPER_INFO and CO_HOSTED_BSS bits set in he_oper_params, which unconditionally drives the read past the element end; there is no race and no unknown state to win. The victim merely needs a 6 GHz-capable radio performing a scan, which is automatic, routine behavior.\\nPR:N - Beacons and 6 GHz broadcast probe responses are parsed during scanning with no authentication, association, or key exchange whatsoever \\u2014 ieee80211_scan_rx() accepts them from any BSSID. The attacker needs no credentials or account on the target.\\nUI:N - Background and connection-triggered scans run automatically on WiFi clients and APs, so the malicious frame is ingested with no victim action. The user never has to select or connect to the rogue AP.\\nS:U - The out-of-bounds read stays within kernel memory managed by the same security authority as the vulnerable cfg80211 code. No VM, IOMMU, or sandbox boundary is crossed.\\nC:L - A single byte is read up to five bytes past the end of the received frame buffer, and its REG_INFO bits steer the BSS use_for/cannot_use_reasons flags that cfg80211 exports to userspace via nl80211 \\u2014 giving a repeatable few-bit oracle on adjacent kernel memory. The disclosure is real but strictly bounded to one byte at a fixed small offset, so Low rather than High.\\nI:N - The bug is a pure read with no out-of-bounds write, no freed-object reuse, and no type confusion, so no attacker-controlled memory modification is possible. The only state it influences is a usability flag on a BSS whose contents the attacker already fully controls.\\nA:H - This is a memory-safety violation reading beyond the frame buffer, which produces a KASAN report (a panic under panic_on_warn or kasan.fault=panic, and a trap under Android arm64 MTE) and can fault outright if the buffer ends at a page boundary. An unauthenticated attacker can replay the malformed beacon continuously, so any resulting oops is trivially repeatable.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"645f3d85129d8aac3b896ba685fbc20a31c2c036\", \"lessThan\": \"f15e3e13e14cc5ae8f950c16efe706add18ac8e2\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"645f3d85129d8aac3b896ba685fbc20a31c2c036\", \"lessThan\": \"4dc3a3893dae5a7f73e5809273aca0f1f3548d55\", \"versionType\": \"git\"}], \"programFiles\": [\"net/wireless/scan.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.8\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.8\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.9.6\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.9.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"net/wireless/scan.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/f15e3e13e14cc5ae8f950c16efe706add18ac8e2\"}, {\"url\": \"https://git.kernel.org/stable/c/4dc3a3893dae5a7f73e5809273aca0f1f3548d55\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: cfg80211: validate HE operation element parsing\\n\\nValidate that the HE operation element has the correct\\nlength before parsing it.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9.6\", \"versionStartIncluding\": \"6.8\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10\", \"versionStartIncluding\": \"6.8\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:34:06.321Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-40930\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:34:06.321Z\", \"dateReserved\": \"2024-07-12T12:17:45.583Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-07-12T12:25:09.110Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.