GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-36921 (GCVE-0-2024-36921)

Vulnerability from cvelistv5 – Published: 2024-05-30 15:29 – Updated: 2026-08-05 11:32
VLAI
Title
wifi: iwlwifi: mvm: guard against invalid STA ID on removal
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: guard against invalid STA ID on removal Guard against invalid station IDs in iwl_mvm_mld_rm_sta_id as that would result in out-of-bounds array accesses. This prevents issues should the driver get into a bad state during error handling.
Severity
8.8 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-10 17:16 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 006c152ac9e56ac7871efa995854c3ff8cf6915a , < 94f80a8ec15e238b78521f20f8afaed60521a294 (git)
Affected: 006c152ac9e56ac7871efa995854c3ff8cf6915a , < fab21d220017daa5fd8a3d788ff25ccfecfaae2f (git)
Affected: 006c152ac9e56ac7871efa995854c3ff8cf6915a , < 17f64517bf5c26af56b6c3566273aad6646c3c4f (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.4
Unaffected: 0 , < 6.4 (semver)
Unaffected: 6.6.31 , ≤ 6.6.* (semver)
Unaffected: 6.8.10 , ≤ 6.8.* (semver)
Unaffected: 6.9 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:43:49.860Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/94f80a8ec15e238b78521f20f8afaed60521a294"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/fab21d220017daa5fd8a3d788ff25ccfecfaae2f"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/17f64517bf5c26af56b6c3566273aad6646c3c4f"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-36921",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T17:16:04.083562Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:35:00.174Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/intel/iwlwifi/mvm/mld-sta.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "94f80a8ec15e238b78521f20f8afaed60521a294",
              "status": "affected",
              "version": "006c152ac9e56ac7871efa995854c3ff8cf6915a",
              "versionType": "git"
            },
            {
              "lessThan": "fab21d220017daa5fd8a3d788ff25ccfecfaae2f",
              "status": "affected",
              "version": "006c152ac9e56ac7871efa995854c3ff8cf6915a",
              "versionType": "git"
            },
            {
              "lessThan": "17f64517bf5c26af56b6c3566273aad6646c3c4f",
              "status": "affected",
              "version": "006c152ac9e56ac7871efa995854c3ff8cf6915a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/intel/iwlwifi/mvm/mld-sta.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.4"
            },
            {
              "lessThan": "6.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.31",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.31",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.10",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: mvm: guard against invalid STA ID on removal\n\nGuard against invalid station IDs in iwl_mvm_mld_rm_sta_id as that would\nresult in out-of-bounds array accesses. This prevents issues should the\ndriver get into a bad state during error handling."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The defect is in the iwlwifi mvm 802.11mc FTM responder / PASN secure-ranging path, exercised on an AP-mode interface in response to nearby stations performing ranging and on firmware-restart handling that an adjacent peer can provoke. Wi-Fi driver reachability is Adjacent, consistent with other iwlwifi mvm CVEs.\nAC:L - Reaching the invalid-STA-ID removal requires the driver to be in an error/teardown state, but an adjacent attacker can drive repeated PASN responder add/remove churn and induce firmware command failures and FW restarts, so the triggering conditions are within attacker influence rather than beyond it.\nPR:N - PASN ranging is negotiated with unassociated peers before any credentials are established, so an adjacent 802.11 device needs no account or privilege on the target; FTM responder mode being enabled is an environmental precondition, not an attacker privilege.\nUI:N - The FTM responder teardown and firmware-restart paths run autonomously in the driver; no action by a local user or administrator is needed once the responder is configured.\nS:U - The out-of-bounds accesses corrupt memory inside the kernel\u0027s own iwlwifi driver state, staying entirely within the kernel security authority with no crossing into a hypervisor, IOMMU, or sandbox boundary.\nC:H - The bug performs an out-of-bounds read of fw_id_to_mac_id[0xFF] and two out-of-bounds writes that silently corrupt live struct iwl_mvm state adjacent to the RCU firmware-station tables; such kernel memory corruption around pointer tables is leverageable toward disclosure of kernel memory.\nI:H - Two out-of-bounds writes zero 8 bytes each ~2 KB past the fw_id_to_mac_id and fw_id_to_link_sta arrays, overwriting unrelated live driver fields inside struct iwl_mvm, and an invalid station ID is fed to firmware \u2014 an out-of-bounds write is a memory-corruption integrity impact.\nA:H - Nulling arbitrary driver fields leads to later NULL dereferences and oopses, the stale OOB-read value causes a STA_REMOVE_CMD with sta_id 0xFF to be sent to firmware which can assert and force a device reset, and the post-fix WARN_ON confirms this is a fatal-state condition."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:32:05.044Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/94f80a8ec15e238b78521f20f8afaed60521a294"
        },
        {
          "url": "https://git.kernel.org/stable/c/fab21d220017daa5fd8a3d788ff25ccfecfaae2f"
        },
        {
          "url": "https://git.kernel.org/stable/c/17f64517bf5c26af56b6c3566273aad6646c3c4f"
        }
      ],
      "title": "wifi: iwlwifi: mvm: guard against invalid STA ID on removal",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-36921",
    "datePublished": "2024-05-30T15:29:15.696Z",
    "dateReserved": "2024-05-30T15:25:07.068Z",
    "dateUpdated": "2026-08-05T11:32:05.044Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-36921",
      "date": "2026-09-16",
      "epss": "0.00345",
      "percentile": "0.27837"
    },
    "microsoft_vex": {
      "current_release_date": "2026-03-31T14:49:53.000Z",
      "cve": "CVE-2024-36921",
      "id": "msrc_CVE-2024-36921",
      "initial_release_date": "2024-05-02T07:00:00.000Z",
      "product_status:known_affected": "3",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "wifi: iwlwifi: mvm: guard against invalid STA ID on removal",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-36921.json",
      "version": "3"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-36921\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-30T16:15:15.397\",\"lastModified\":\"2026-08-04T11:18:31.607\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: iwlwifi: mvm: guard against invalid STA ID on removal\\n\\nGuard against invalid station IDs in iwl_mvm_mld_rm_sta_id as that would\\nresult in out-of-bounds array accesses. This prevents issues should the\\ndriver get into a bad state during error handling.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: wifi: iwlwifi: mvm: proteger contra ID de STA no v\u00e1lido al eliminarlo Proteger contra ID de estaci\u00f3n no v\u00e1lidos en iwl_mvm_mld_rm_sta_id ya que eso dar\u00eda como resultado accesos a la matriz fuera de los l\u00edmites. Esto evita problemas en caso de que el controlador entre en mal estado durante el manejo de errores.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/wireless/intel/iwlwifi/mvm/mld-sta.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"006c152ac9e56ac7871efa995854c3ff8cf6915a\",\"lessThan\":\"94f80a8ec15e238b78521f20f8afaed60521a294\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"006c152ac9e56ac7871efa995854c3ff8cf6915a\",\"lessThan\":\"fab21d220017daa5fd8a3d788ff25ccfecfaae2f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"006c152ac9e56ac7871efa995854c3ff8cf6915a\",\"lessThan\":\"17f64517bf5c26af56b6c3566273aad6646c3c4f\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/wireless/intel/iwlwifi/mvm/mld-sta.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.4\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.4\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.31\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.8.10\",\"lessThanOrEqual\":\"6.8.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.9\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-10T17:16:04.083562Z\",\"id\":\"CVE-2024-36921\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-129\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"6.6.31\",\"matchCriteriaId\":\"E3E590E3-9122-405E-A816-1B69540EC77D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.8.10\",\"matchCriteriaId\":\"6A6B920C-8D8F-4130-86B4-AD334F4CF2E3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"22BEDD49-2C6D-402D-9DBF-6646F6ECD10B\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/17f64517bf5c26af56b6c3566273aad6646c3c4f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/94f80a8ec15e238b78521f20f8afaed60521a294\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/fab21d220017daa5fd8a3d788ff25ccfecfaae2f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/17f64517bf5c26af56b6c3566273aad6646c3c4f\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/94f80a8ec15e238b78521f20f8afaed60521a294\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/fab21d220017daa5fd8a3d788ff25ccfecfaae2f\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T18:56:54+00:00",
      "cve": "CVE-2024-36921",
      "id": "CVE-2024-36921",
      "initial_release_date": "2024-05-30T00:00:00+00:00",
      "product_status:fixed": "429",
      "product_status:known_affected": "22",
      "product_status:known_not_affected": "50",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: wifi: iwlwifi: mvm: guard against invalid STA ID on removal",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-36921.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/94f80a8ec15e238b78521f20f8afaed60521a294\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/fab21d220017daa5fd8a3d788ff25ccfecfaae2f\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/17f64517bf5c26af56b6c3566273aad6646c3c4f\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T03:43:49.860Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-36921\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T17:16:04.083562Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:27.410Z\"}}], \"cna\": {\"title\": \"wifi: iwlwifi: mvm: guard against invalid STA ID on removal\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 8.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:A - The defect is in the iwlwifi mvm 802.11mc FTM responder / PASN secure-ranging path, exercised on an AP-mode interface in response to nearby stations performing ranging and on firmware-restart handling that an adjacent peer can provoke. Wi-Fi driver reachability is Adjacent, consistent with other iwlwifi mvm CVEs.\\nAC:L - Reaching the invalid-STA-ID removal requires the driver to be in an error/teardown state, but an adjacent attacker can drive repeated PASN responder add/remove churn and induce firmware command failures and FW restarts, so the triggering conditions are within attacker influence rather than beyond it.\\nPR:N - PASN ranging is negotiated with unassociated peers before any credentials are established, so an adjacent 802.11 device needs no account or privilege on the target; FTM responder mode being enabled is an environmental precondition, not an attacker privilege.\\nUI:N - The FTM responder teardown and firmware-restart paths run autonomously in the driver; no action by a local user or administrator is needed once the responder is configured.\\nS:U - The out-of-bounds accesses corrupt memory inside the kernel\u0027s own iwlwifi driver state, staying entirely within the kernel security authority with no crossing into a hypervisor, IOMMU, or sandbox boundary.\\nC:H - The bug performs an out-of-bounds read of fw_id_to_mac_id[0xFF] and two out-of-bounds writes that silently corrupt live struct iwl_mvm state adjacent to the RCU firmware-station tables; such kernel memory corruption around pointer tables is leverageable toward disclosure of kernel memory.\\nI:H - Two out-of-bounds writes zero 8 bytes each ~2 KB past the fw_id_to_mac_id and fw_id_to_link_sta arrays, overwriting unrelated live driver fields inside struct iwl_mvm, and an invalid station ID is fed to firmware \\u2014 an out-of-bounds write is a memory-corruption integrity impact.\\nA:H - Nulling arbitrary driver fields leads to later NULL dereferences and oopses, the stale OOB-read value causes a STA_REMOVE_CMD with sta_id 0xFF to be sent to firmware which can assert and force a device reset, and the post-fix WARN_ON confirms this is a fatal-state condition.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"006c152ac9e56ac7871efa995854c3ff8cf6915a\", \"lessThan\": \"94f80a8ec15e238b78521f20f8afaed60521a294\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"006c152ac9e56ac7871efa995854c3ff8cf6915a\", \"lessThan\": \"fab21d220017daa5fd8a3d788ff25ccfecfaae2f\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"006c152ac9e56ac7871efa995854c3ff8cf6915a\", \"lessThan\": \"17f64517bf5c26af56b6c3566273aad6646c3c4f\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/net/wireless/intel/iwlwifi/mvm/mld-sta.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.4\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.4\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.6.31\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8.10\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.8.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/net/wireless/intel/iwlwifi/mvm/mld-sta.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/94f80a8ec15e238b78521f20f8afaed60521a294\"}, {\"url\": \"https://git.kernel.org/stable/c/fab21d220017daa5fd8a3d788ff25ccfecfaae2f\"}, {\"url\": \"https://git.kernel.org/stable/c/17f64517bf5c26af56b6c3566273aad6646c3c4f\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: iwlwifi: mvm: guard against invalid STA ID on removal\\n\\nGuard against invalid station IDs in iwl_mvm_mld_rm_sta_id as that would\\nresult in out-of-bounds array accesses. This prevents issues should the\\ndriver get into a bad state during error handling.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.31\", \"versionStartIncluding\": \"6.4\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8.10\", \"versionStartIncluding\": \"6.4\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9\", \"versionStartIncluding\": \"6.4\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:32:05.044Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-36921\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:32:05.044Z\", \"dateReserved\": \"2024-05-30T15:25:07.068Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-30T15:29:15.696Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.