GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-47714 (GCVE-0-2024-47714)

Vulnerability from cvelistv5 – Published: 2024-10-21 11:53 – Updated: 2026-08-05 11:39
VLAI
Title
wifi: mt76: mt7996: use hweight16 to get correct tx antenna
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: use hweight16 to get correct tx antenna The chainmask is u16 so using hweight8 cannot get correct tx_ant. Without this patch, the tx_ant of band 2 would be -1 and lead to the following issue: BUG: KASAN: stack-out-of-bounds in mt7996_mcu_add_sta+0x12e0/0x16e0 [mt7996e]
Severity
7.6 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-21 13:02 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 98686cd21624c75a043e96812beadddf4f6f48e5 , < 50d87e3b70980abc090676b6b4703fcbd96221f9 (git)
Affected: 98686cd21624c75a043e96812beadddf4f6f48e5 , < 8f51fc8a9e2fd96363d8ec3f4ee4b78dd64754e3 (git)
Affected: 98686cd21624c75a043e96812beadddf4f6f48e5 , < 33954930870c18ec549e4bca0eeff43e252cb740 (git)
Affected: 98686cd21624c75a043e96812beadddf4f6f48e5 , < f98c3de92bb05dac4a4969df8a4595ed380b4604 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.2
Unaffected: 0 , < 6.2 (semver)
Unaffected: 6.6.54 , ≤ 6.6.* (semver)
Unaffected: 6.10.13 , ≤ 6.10.* (semver)
Unaffected: 6.11.2 , ≤ 6.11.* (semver)
Unaffected: 6.12 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-47714",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-21T13:02:52.416293Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-21T13:04:18.545Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/mediatek/mt76/mt7996/mcu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "50d87e3b70980abc090676b6b4703fcbd96221f9",
              "status": "affected",
              "version": "98686cd21624c75a043e96812beadddf4f6f48e5",
              "versionType": "git"
            },
            {
              "lessThan": "8f51fc8a9e2fd96363d8ec3f4ee4b78dd64754e3",
              "status": "affected",
              "version": "98686cd21624c75a043e96812beadddf4f6f48e5",
              "versionType": "git"
            },
            {
              "lessThan": "33954930870c18ec549e4bca0eeff43e252cb740",
              "status": "affected",
              "version": "98686cd21624c75a043e96812beadddf4f6f48e5",
              "versionType": "git"
            },
            {
              "lessThan": "f98c3de92bb05dac4a4969df8a4595ed380b4604",
              "status": "affected",
              "version": "98686cd21624c75a043e96812beadddf4f6f48e5",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/mediatek/mt76/mt7996/mcu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.2"
            },
            {
              "lessThan": "6.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.54",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.54",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.13",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.2",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: mt7996: use hweight16 to get correct tx antenna\n\nThe chainmask is u16 so using hweight8 cannot get correct tx_ant.\nWithout this patch, the tx_ant of band 2 would be -1 and lead to the\nfollowing issue:\nBUG: KASAN: stack-out-of-bounds in mt7996_mcu_add_sta+0x12e0/0x16e0 [mt7996e]"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The vulnerable path is entered from mac80211 station insertion driven by an over-the-air association from a nearby 802.11 peer, with the trigger conditions (EHT/HE/VHT beamforming capability bits, bandwidth, MCS/NSS fields) taken straight from the attacker\u0027s association request. This requires radio proximity to the AP\u0027s 6 GHz band rather than routable network access, which is Adjacent per the WiFi frame-injection guidance.\nAC:L - On the affected hardware the miscount is deterministic \u2014 band 2\u0027s chainmask sits entirely above bit 7, so hweight8() always returns 0 and tx_ant is always -1 \u2014 and the attacker simply associates while advertising SU-beamformee support to reach matrix[-1][ncol] every time. There is no race, no memory-layout requirement, and the attempt can be repeated indefinitely by re-associating.\nPR:N - In AP mode hostapd creates the station object at association, before the 4-way handshake or any credential validation, so mt7996_mac_sta_add() \u2192 mt7996_mcu_sta_bfer_tlv() runs for an attacker holding no key and no account on the target. Open and mesh/IBSS deployments have no authentication gate at all.\nUI:N - The attacker performs the association itself and the AP\u0027s kernel processes it automatically; no action by any user or administrator on the victim system is needed.\nS:U - The out-of-bounds read and the resulting bogus firmware-command fields stay within the kernel driver\u0027s own security authority, crossing no VM, IOMMU, or sandbox boundary.\nC:L - matrix[-1][ncol] reads adjacent kernel stack memory outside the const array, exposing stack contents that are then written into the sta_rec_bf TLV and transmitted to the WiFi firmware. The read is strictly bounded to the four bytes immediately preceding a 16-byte object at a fixed negative offset with no attacker-directed address and no channel returning the data over the air, so it is a small bounded leak rather than arbitrary read.\nI:L - The uninitialized out-of-bounds byte and the underflowed antenna count (ibf_nrow = 0xFF, mem_20m/mem_total derived from stray stack data) are programmed into the chip\u0027s beamforming profile via the MCU STA_REC_UPDATE command, a remotely-influenced corruption of device configuration state. No kernel memory is written out of bounds and no control-flow influence is available, so the modification is limited rather than arbitrary.\nA:H - The condition is a KASAN-detected stack-out-of-bounds in mt7996_mcu_add_sta(), which oopses and panics outright on kernels built with KASAN plus panic_on_warn or kasan.fault=panic \u2014 common in vendor and hardened builds. Independently, feeding out-of-range beamforming memory parameters and a 0xFF antenna count to the WiFi MCU can wedge the firmware and take the radio down, and the attacker can retrigger it on every association."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:39:40.668Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/50d87e3b70980abc090676b6b4703fcbd96221f9"
        },
        {
          "url": "https://git.kernel.org/stable/c/8f51fc8a9e2fd96363d8ec3f4ee4b78dd64754e3"
        },
        {
          "url": "https://git.kernel.org/stable/c/33954930870c18ec549e4bca0eeff43e252cb740"
        },
        {
          "url": "https://git.kernel.org/stable/c/f98c3de92bb05dac4a4969df8a4595ed380b4604"
        }
      ],
      "title": "wifi: mt76: mt7996: use hweight16 to get correct tx antenna",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-47714",
    "datePublished": "2024-10-21T11:53:46.090Z",
    "dateReserved": "2024-09-30T16:00:12.948Z",
    "dateUpdated": "2026-08-05T11:39:40.668Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-47714",
      "date": "2026-09-16",
      "epss": "0.00283",
      "percentile": "0.20925"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.2\", \"versionEndExcluding\": \"6.6.54\", \"matchCriteriaId\": \"D448821D-C085-4CAF-88FA-2DDE7BE21976\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.7\", \"versionEndExcluding\": \"6.10.13\", \"matchCriteriaId\": \"CE94BB8D-B0AB-4563-9ED7-A12122B56EBE\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.11\", \"versionEndExcluding\": \"6.11.2\", \"matchCriteriaId\": \"AB755D26-97F4-43B6-8604-CD076811E181\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: mt76: mt7996: use hweight16 to get correct tx antenna\\n\\nThe chainmask is u16 so using hweight8 cannot get correct tx_ant.\\nWithout this patch, the tx_ant of band 2 would be -1 and lead to the\\nfollowing issue:\\nBUG: KASAN: stack-out-of-bounds in mt7996_mcu_add_sta+0x12e0/0x16e0 [mt7996e]\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: wifi: mt76: mt7996: usar hweight16 para obtener la antena tx correcta La m\\u00e1scara de cadena es u16, por lo que usar hweight8 no puede obtener la tx_ant correcta. Sin este parche, la tx_ant de la banda 2 ser\\u00eda -1 y provocar\\u00eda el siguiente problema: ERROR: KASAN: pila fuera de los l\\u00edmites en mt7996_mcu_add_sta+0x12e0/0x16e0 [mt7996e]\"}]",
      "id": "CVE-2024-47714",
      "lastModified": "2024-10-24T14:33:17.720",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 3.6}]}",
      "published": "2024-10-21T12:15:07.797",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/33954930870c18ec549e4bca0eeff43e252cb740\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/50d87e3b70980abc090676b6b4703fcbd96221f9\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/8f51fc8a9e2fd96363d8ec3f4ee4b78dd64754e3\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/f98c3de92bb05dac4a4969df8a4595ed380b4604\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-787\"}]}]"
    },
    "microsoft_vex": {
      "current_release_date": "2024-11-09T00:00:00.000Z",
      "cve": "CVE-2024-47714",
      "id": "msrc_CVE-2024-47714",
      "initial_release_date": "2024-10-01T07:00:00.000Z",
      "product_status:fixed": "2",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "wifi: mt76: mt7996: use hweight16 to get correct tx antenna",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-47714.json",
      "version": "1"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-47714\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-10-21T12:15:07.797\",\"lastModified\":\"2026-08-04T11:20:43.840\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: mt76: mt7996: use hweight16 to get correct tx antenna\\n\\nThe chainmask is u16 so using hweight8 cannot get correct tx_ant.\\nWithout this patch, the tx_ant of band 2 would be -1 and lead to the\\nfollowing issue:\\nBUG: KASAN: stack-out-of-bounds in mt7996_mcu_add_sta+0x12e0/0x16e0 [mt7996e]\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: wifi: mt76: mt7996: usar hweight16 para obtener la antena tx correcta La m\u00e1scara de cadena es u16, por lo que usar hweight8 no puede obtener la tx_ant correcta. Sin este parche, la tx_ant de la banda 2 ser\u00eda -1 y provocar\u00eda el siguiente problema: ERROR: KASAN: pila fuera de los l\u00edmites en mt7996_mcu_add_sta+0x12e0/0x16e0 [mt7996e]\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/wireless/mediatek/mt76/mt7996/mcu.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"98686cd21624c75a043e96812beadddf4f6f48e5\",\"lessThan\":\"50d87e3b70980abc090676b6b4703fcbd96221f9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"98686cd21624c75a043e96812beadddf4f6f48e5\",\"lessThan\":\"8f51fc8a9e2fd96363d8ec3f4ee4b78dd64754e3\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"98686cd21624c75a043e96812beadddf4f6f48e5\",\"lessThan\":\"33954930870c18ec549e4bca0eeff43e252cb740\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"98686cd21624c75a043e96812beadddf4f6f48e5\",\"lessThan\":\"f98c3de92bb05dac4a4969df8a4595ed380b4604\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/wireless/mediatek/mt76/mt7996/mcu.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.2\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.2\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.54\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10.13\",\"lessThanOrEqual\":\"6.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.11.2\",\"lessThanOrEqual\":\"6.11.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H\",\"baseScore\":7.6,\"baseSeverity\":\"HIGH\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":4.7},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-10-21T13:02:52.416293Z\",\"id\":\"CVE-2024-47714\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-787\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.54\",\"matchCriteriaId\":\"D448821D-C085-4CAF-88FA-2DDE7BE21976\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.10.13\",\"matchCriteriaId\":\"CE94BB8D-B0AB-4563-9ED7-A12122B56EBE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.11\",\"versionEndExcluding\":\"6.11.2\",\"matchCriteriaId\":\"AB755D26-97F4-43B6-8604-CD076811E181\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/33954930870c18ec549e4bca0eeff43e252cb740\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/50d87e3b70980abc090676b6b4703fcbd96221f9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8f51fc8a9e2fd96363d8ec3f4ee4b78dd64754e3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f98c3de92bb05dac4a4969df8a4595ed380b4604\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-13T10:03:35+00:00",
      "cve": "CVE-2024-47714",
      "id": "CVE-2024-47714",
      "initial_release_date": "2024-10-21T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: wifi: mt76: mt7996: use hweight16 to get correct tx antenna",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-47714.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-22T01:30:51Z",
      "cve": "CVE-2024-47714",
      "id": "CVE-2024-47714",
      "initial_release_date": "2024-10-21T15:47:03Z",
      "product_status:known_affected": "394",
      "product_status:known_not_affected": "340",
      "product_status:recommended": "397",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-47714",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-47714.json",
      "version": "59"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-47714\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-10-21T13:02:52.416293Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-10-21T13:02:55.538Z\"}}], \"cna\": {\"title\": \"wifi: mt76: mt7996: use hweight16 to get correct tx antenna\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.6, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H\"}}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"98686cd21624c75a043e96812beadddf4f6f48e5\", \"lessThan\": \"50d87e3b70980abc090676b6b4703fcbd96221f9\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"98686cd21624c75a043e96812beadddf4f6f48e5\", \"lessThan\": \"8f51fc8a9e2fd96363d8ec3f4ee4b78dd64754e3\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"98686cd21624c75a043e96812beadddf4f6f48e5\", \"lessThan\": \"33954930870c18ec549e4bca0eeff43e252cb740\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"98686cd21624c75a043e96812beadddf4f6f48e5\", \"lessThan\": \"f98c3de92bb05dac4a4969df8a4595ed380b4604\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/net/wireless/mediatek/mt76/mt7996/mcu.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.2\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.2\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.6.54\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10.13\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11.2\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.11.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/net/wireless/mediatek/mt76/mt7996/mcu.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/50d87e3b70980abc090676b6b4703fcbd96221f9\"}, {\"url\": \"https://git.kernel.org/stable/c/8f51fc8a9e2fd96363d8ec3f4ee4b78dd64754e3\"}, {\"url\": \"https://git.kernel.org/stable/c/33954930870c18ec549e4bca0eeff43e252cb740\"}, {\"url\": \"https://git.kernel.org/stable/c/f98c3de92bb05dac4a4969df8a4595ed380b4604\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: mt76: mt7996: use hweight16 to get correct tx antenna\\n\\nThe chainmask is u16 so using hweight8 cannot get correct tx_ant.\\nWithout this patch, the tx_ant of band 2 would be -1 and lead to the\\nfollowing issue:\\nBUG: KASAN: stack-out-of-bounds in mt7996_mcu_add_sta+0x12e0/0x16e0 [mt7996e]\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.54\", \"versionStartIncluding\": \"6.2\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10.13\", \"versionStartIncluding\": \"6.2\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11.2\", \"versionStartIncluding\": \"6.2\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12\", \"versionStartIncluding\": \"6.2\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-04T09:32:56.603Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-47714\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-04T09:32:56.603Z\", \"dateReserved\": \"2024-09-30T16:00:12.948Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-10-21T11:53:46.090Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.