CVE-2024-35789

wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes When moving a station out of a VLAN and deleting the VLAN afterwards, the fast_rx entry still holds a pointer to the VLAN's netdev, which can cause use-after-free bugs. Fix this by immediately calling ieee80211_check_fast_rx after the VLAN change.

N/A

CVSS

Severity:

EPSS 0.24%

Affected: Linux Linux

References

Link	Tags
https://git.kernel.org/stable/c/ea9a0cfc07a7d3601cc680718d9cff0d6927a921
https://git.kernel.org/stable/c/be1dd9254fc115321d6fbee042026d42afc8d931
https://git.kernel.org/stable/c/e8b067c4058c0121ac8ca71559df8e2e08ff1a7e
https://git.kernel.org/stable/c/c8bddbd91bc8e42c961a5e2cec20ab879f21100f
https://git.kernel.org/stable/c/7eeabcea79b67cc29563e6a9a5c81f9e2c664d5b
https://git.kernel.org/stable/c/6b948b54c8bd620725e0c906e44b10c0b13087a7
https://git.kernel.org/stable/c/2884a50f52313a7a911de3afcad065ddbb3d78fc
https://git.kernel.org/stable/c/e8678551c0243f799b4859448781cbec1bd6f1cb
https://git.kernel.org/stable/c/4f2bdb3c5e3189297e156b3ff84b140423d64685
https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html
https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html

Frequently Asked Questions

What is the severity of CVE-2024-35789?: CVE-2024-35789 has not yet been assigned a CVSS score.
How to fix CVE-2024-35789?: To fix CVE-2024-35789, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2024-35789 being actively exploited in the wild?: As for now, there are no information to confirm that CVE-2024-35789 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2024-35789?: CVE-2024-35789 affects Linux Linux, Linux Linux.

This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.