CVE-2024-57898

wifi: cfg80211: clear link ID from bitmap during link delete after clean up

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: clear link ID from bitmap during link delete after clean up Currently, during link deletion, the link ID is first removed from the valid_links bitmap before performing any clean-up operations. However, some functions require the link ID to remain in the valid_links bitmap. One such example is cfg80211_cac_event(). The flow is - nl80211_remove_link() cfg80211_remove_link() ieee80211_del_intf_link() ieee80211_vif_set_links() ieee80211_vif_update_links() ieee80211_link_stop() cfg80211_cac_event() cfg80211_cac_event() requires link ID to be present but it is cleared already in cfg80211_remove_link(). Ultimately, WARN_ON() is hit. Therefore, clear the link ID from the bitmap only after completing the link clean-up.

N/A

CVSS

Severity:

EPSS 0.05%

Affected: Linux Linux

References

Link	Tags
https://git.kernel.org/stable/c/ae07daf440d3220d0986e676317a5da66e4f9dfd
https://git.kernel.org/stable/c/b5c32ff6a3a38c74facdd1fe34c0d709a55527fd

Frequently Asked Questions

What is the severity of CVE-2024-57898?: CVE-2024-57898 has not yet been assigned a CVSS score.
How to fix CVE-2024-57898?: To fix CVE-2024-57898, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2024-57898 being actively exploited in the wild?: As for now, there are no information to confirm that CVE-2024-57898 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2024-57898?: CVE-2024-57898 affects Linux Linux, Linux Linux.

This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.