CVE-2024-36922 (GCVE-0-2024-36922)

Vulnerability from cvelistv5 – Published: 2024-05-30 15:29 – Updated: 2026-08-05 11:32
VLAI
Title
wifi: iwlwifi: read txq->read_ptr under lock
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: read txq->read_ptr under lock If we read txq->read_ptr without lock, we can read the same value twice, then obtain the lock, and reclaim from there to two different places, but crucially reclaim the same entry twice, resulting in the WARN_ONCE() a little later. Fix that by reading txq->read_ptr under lock.
Severity
8.8 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 7b3e42ea2eadd41cc9d6363a9813b8ba8ab6f0e6 , < f30e8af109818c9db08cbcc46eb9713fe4b530ba (git)
Affected: 7b3e42ea2eadd41cc9d6363a9813b8ba8ab6f0e6 , < aab7b39fcac5f6165f6434bcbb56bb7865d4ad2b (git)
Affected: 7b3e42ea2eadd41cc9d6363a9813b8ba8ab6f0e6 , < b83db8e756dec68a950ed2f056248b1704b3deaa (git)
Affected: 7b3e42ea2eadd41cc9d6363a9813b8ba8ab6f0e6 , < 43d07103df670484cdd26f9588eabef80f69db89 (git)
Affected: 7b3e42ea2eadd41cc9d6363a9813b8ba8ab6f0e6 , < c2ace6300600c634553657785dfe5ea0ed688ac2 (git)
Create a notification for this product.
Linux Linux Affected: 4.19
Unaffected: 0 , < 4.19 (semver)
Unaffected: 5.15.209 , ≤ 5.15.* (semver)
Unaffected: 6.1.175 , ≤ 6.1.* (semver)
Unaffected: 6.6.31 , ≤ 6.6.* (semver)
Unaffected: 6.8.10 , ≤ 6.8.* (semver)
Unaffected: 6.9 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:43:49.981Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/b83db8e756dec68a950ed2f056248b1704b3deaa"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/43d07103df670484cdd26f9588eabef80f69db89"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/c2ace6300600c634553657785dfe5ea0ed688ac2"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-36922",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T17:16:00.944037Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:34:59.986Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/intel/iwlwifi/queue/tx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f30e8af109818c9db08cbcc46eb9713fe4b530ba",
              "status": "affected",
              "version": "7b3e42ea2eadd41cc9d6363a9813b8ba8ab6f0e6",
              "versionType": "git"
            },
            {
              "lessThan": "aab7b39fcac5f6165f6434bcbb56bb7865d4ad2b",
              "status": "affected",
              "version": "7b3e42ea2eadd41cc9d6363a9813b8ba8ab6f0e6",
              "versionType": "git"
            },
            {
              "lessThan": "b83db8e756dec68a950ed2f056248b1704b3deaa",
              "status": "affected",
              "version": "7b3e42ea2eadd41cc9d6363a9813b8ba8ab6f0e6",
              "versionType": "git"
            },
            {
              "lessThan": "43d07103df670484cdd26f9588eabef80f69db89",
              "status": "affected",
              "version": "7b3e42ea2eadd41cc9d6363a9813b8ba8ab6f0e6",
              "versionType": "git"
            },
            {
              "lessThan": "c2ace6300600c634553657785dfe5ea0ed688ac2",
              "status": "affected",
              "version": "7b3e42ea2eadd41cc9d6363a9813b8ba8ab6f0e6",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/intel/iwlwifi/queue/tx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.19"
            },
            {
              "lessThan": "4.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.209",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.31",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.209",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.175",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.31",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.10",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: read txq-\u003eread_ptr under lock\n\nIf we read txq-\u003eread_ptr without lock, we can read the same\nvalue twice, then obtain the lock, and reclaim from there\nto two different places, but crucially reclaim the same\nentry twice, resulting in the WARN_ONCE() a little later.\nFix that by reading txq-\u003eread_ptr under lock."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The vulnerable reclaim path is driven entirely by over-the-air activity \u2014 firmware TX/BA completions for transmitted frames and flush operations triggered by connection-state changes \u2014 so an attacker within WiFi radio range (rogue AP or frame injection) can drive it. Per WiFi frame-injection guidance this is Adjacent, not Local.\nAC:L - The attacker controls both sides of the race: sustained traffic keeps TX_CMD/BA_NOTIF reclaims firing in the RX softirq path, while injected deauth/disassoc or channel-switch frames repeatedly trigger the process-context flush reclaim, and the attempt can be retried indefinitely at high rate until the unlocked read is interleaved.\nPR:N - No credentials or authentication are required \u2014 deauth/disassoc injection and rogue-AP association handling are pre-authentication, and the reclaim path is exercised by ordinary unauthenticated 802.11 traffic and management frames.\nUI:N - No victim action is needed; an active WiFi connection carrying traffic is the normal operating state, and the flush/completion interleaving happens without any user involvement.\nS:U - The corrupted TX queue state, leaked buffers and resulting crash are all confined to the kernel\u0027s own security authority; no VM, IOMMU or sandbox boundary is crossed.\nC:H - The desynchronized read_ptr lets the loop unmap DMA buffers and release skbs for TFDs the firmware still owns, leaving stale valid TFDs in the ring that the device can fetch and transmit, exposing kernel buffer contents over the air; per guidance, memory corruption leverageable for disclosure is High.\nI:H - Premature reclaim tears down DMA mappings and frees buffers still referenced by hardware TFDs, so the device can DMA into unmapped or reallocated memory, and the ring accounting itself is corrupted \u2014 a memory-corruption primitive rather than a bounded state error.\nA:H - The bug directly produces WARN_ONCE/WARN_ON splats (a panic under panic_on_warn), and the corrupted read_ptr makes iwl_txq_space() return 0 permanently, wedging the TX queue and triggering the queue-stuck watchdog/firmware restart with loss of connectivity."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:32:06.118Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f30e8af109818c9db08cbcc46eb9713fe4b530ba"
        },
        {
          "url": "https://git.kernel.org/stable/c/aab7b39fcac5f6165f6434bcbb56bb7865d4ad2b"
        },
        {
          "url": "https://git.kernel.org/stable/c/b83db8e756dec68a950ed2f056248b1704b3deaa"
        },
        {
          "url": "https://git.kernel.org/stable/c/43d07103df670484cdd26f9588eabef80f69db89"
        },
        {
          "url": "https://git.kernel.org/stable/c/c2ace6300600c634553657785dfe5ea0ed688ac2"
        }
      ],
      "title": "wifi: iwlwifi: read txq-\u003eread_ptr under lock",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-36922",
    "datePublished": "2024-05-30T15:29:16.852Z",
    "dateReserved": "2024-05-30T15:25:07.068Z",
    "dateUpdated": "2026-08-05T11:32:06.118Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-36922",
      "date": "2026-08-05",
      "epss": "0.00348",
      "percentile": "0.2746"
    },
    "microsoft_vex": {
      "current_release_date": "2026-03-31T15:17:21.000Z",
      "cve": "CVE-2024-36922",
      "id": "msrc_CVE-2024-36922",
      "initial_release_date": "2024-05-02T07:00:00.000Z",
      "product_status:known_affected": "3",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "wifi: iwlwifi: read txq-\u003eread_ptr under lock",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-36922.json",
      "version": "3"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-36922\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-30T16:15:15.470\",\"lastModified\":\"2026-06-17T07:37:22.137\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: iwlwifi: read txq-\u003eread_ptr under lock\\n\\nIf we read txq-\u003eread_ptr without lock, we can read the same\\nvalue twice, then obtain the lock, and reclaim from there\\nto two different places, but crucially reclaim the same\\nentry twice, resulting in the WARN_ONCE() a little later.\\nFix that by reading txq-\u003eread_ptr under lock.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: wifi: iwlwifi: leer txq-\u0026gt;read_ptr bajo bloqueo Si leemos txq-\u0026gt;read_ptr sin bloqueo, podemos leer el mismo valor dos veces, luego obtener el bloqueo y reclamar desde all\u00ed a dos lugares diferentes, pero fundamentalmente reclama la misma entrada dos veces, lo que resulta en WARN_ONCE() un poco m\u00e1s tarde. Solucione eso leyendo txq-\u0026gt;read_ptr bajo bloqueo.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/wireless/intel/iwlwifi/queue/tx.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"7b3e42ea2eadd41cc9d6363a9813b8ba8ab6f0e6\",\"lessThan\":\"f30e8af109818c9db08cbcc46eb9713fe4b530ba\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7b3e42ea2eadd41cc9d6363a9813b8ba8ab6f0e6\",\"lessThan\":\"aab7b39fcac5f6165f6434bcbb56bb7865d4ad2b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7b3e42ea2eadd41cc9d6363a9813b8ba8ab6f0e6\",\"lessThan\":\"b83db8e756dec68a950ed2f056248b1704b3deaa\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7b3e42ea2eadd41cc9d6363a9813b8ba8ab6f0e6\",\"lessThan\":\"43d07103df670484cdd26f9588eabef80f69db89\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7b3e42ea2eadd41cc9d6363a9813b8ba8ab6f0e6\",\"lessThan\":\"c2ace6300600c634553657785dfe5ea0ed688ac2\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/wireless/intel/iwlwifi/queue/tx.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.19\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.19\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.209\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.175\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.31\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.8.10\",\"lessThanOrEqual\":\"6.8.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.9\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-10T17:16:00.944037Z\",\"id\":\"CVE-2024-36922\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"6.6.31\",\"matchCriteriaId\":\"E3E590E3-9122-405E-A816-1B69540EC77D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.8.10\",\"matchCriteriaId\":\"6A6B920C-8D8F-4130-86B4-AD334F4CF2E3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"22BEDD49-2C6D-402D-9DBF-6646F6ECD10B\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/43d07103df670484cdd26f9588eabef80f69db89\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/aab7b39fcac5f6165f6434bcbb56bb7865d4ad2b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b83db8e756dec68a950ed2f056248b1704b3deaa\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c2ace6300600c634553657785dfe5ea0ed688ac2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f30e8af109818c9db08cbcc46eb9713fe4b530ba\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/43d07103df670484cdd26f9588eabef80f69db89\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b83db8e756dec68a950ed2f056248b1704b3deaa\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c2ace6300600c634553657785dfe5ea0ed688ac2\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T22:45:41+00:00",
      "cve": "CVE-2024-36922",
      "id": "CVE-2024-36922",
      "initial_release_date": "2024-05-30T00:00:00+00:00",
      "product_status:fixed": "634",
      "product_status:known_affected": "38",
      "product_status:known_not_affected": "50",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: wifi: iwlwifi: read txq-\u0026gt;read_ptr under lock",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-36922.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/b83db8e756dec68a950ed2f056248b1704b3deaa\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/43d07103df670484cdd26f9588eabef80f69db89\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/c2ace6300600c634553657785dfe5ea0ed688ac2\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T03:43:49.981Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-36922\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T17:16:00.944037Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:27.399Z\"}}], \"cna\": {\"title\": \"wifi: iwlwifi: read txq-\u003eread_ptr under lock\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 8.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:A - The vulnerable reclaim path is driven entirely by over-the-air activity \\u2014 firmware TX/BA completions for transmitted frames and flush operations triggered by connection-state changes \\u2014 so an attacker within WiFi radio range (rogue AP or frame injection) can drive it. Per WiFi frame-injection guidance this is Adjacent, not Local.\\nAC:L - The attacker controls both sides of the race: sustained traffic keeps TX_CMD/BA_NOTIF reclaims firing in the RX softirq path, while injected deauth/disassoc or channel-switch frames repeatedly trigger the process-context flush reclaim, and the attempt can be retried indefinitely at high rate until the unlocked read is interleaved.\\nPR:N - No credentials or authentication are required \\u2014 deauth/disassoc injection and rogue-AP association handling are pre-authentication, and the reclaim path is exercised by ordinary unauthenticated 802.11 traffic and management frames.\\nUI:N - No victim action is needed; an active WiFi connection carrying traffic is the normal operating state, and the flush/completion interleaving happens without any user involvement.\\nS:U - The corrupted TX queue state, leaked buffers and resulting crash are all confined to the kernel\u0027s own security authority; no VM, IOMMU or sandbox boundary is crossed.\\nC:H - The desynchronized read_ptr lets the loop unmap DMA buffers and release skbs for TFDs the firmware still owns, leaving stale valid TFDs in the ring that the device can fetch and transmit, exposing kernel buffer contents over the air; per guidance, memory corruption leverageable for disclosure is High.\\nI:H - Premature reclaim tears down DMA mappings and frees buffers still referenced by hardware TFDs, so the device can DMA into unmapped or reallocated memory, and the ring accounting itself is corrupted \\u2014 a memory-corruption primitive rather than a bounded state error.\\nA:H - The bug directly produces WARN_ONCE/WARN_ON splats (a panic under panic_on_warn), and the corrupted read_ptr makes iwl_txq_space() return 0 permanently, wedging the TX queue and triggering the queue-stuck watchdog/firmware restart with loss of connectivity.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"7b3e42ea2eadd41cc9d6363a9813b8ba8ab6f0e6\", \"lessThan\": \"f30e8af109818c9db08cbcc46eb9713fe4b530ba\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"7b3e42ea2eadd41cc9d6363a9813b8ba8ab6f0e6\", \"lessThan\": \"aab7b39fcac5f6165f6434bcbb56bb7865d4ad2b\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"7b3e42ea2eadd41cc9d6363a9813b8ba8ab6f0e6\", \"lessThan\": \"b83db8e756dec68a950ed2f056248b1704b3deaa\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"7b3e42ea2eadd41cc9d6363a9813b8ba8ab6f0e6\", \"lessThan\": \"43d07103df670484cdd26f9588eabef80f69db89\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"7b3e42ea2eadd41cc9d6363a9813b8ba8ab6f0e6\", \"lessThan\": \"c2ace6300600c634553657785dfe5ea0ed688ac2\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/net/wireless/intel/iwlwifi/queue/tx.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.19\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"4.19\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.15.209\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.175\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.31\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8.10\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.8.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/net/wireless/intel/iwlwifi/queue/tx.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/f30e8af109818c9db08cbcc46eb9713fe4b530ba\"}, {\"url\": \"https://git.kernel.org/stable/c/aab7b39fcac5f6165f6434bcbb56bb7865d4ad2b\"}, {\"url\": \"https://git.kernel.org/stable/c/b83db8e756dec68a950ed2f056248b1704b3deaa\"}, {\"url\": \"https://git.kernel.org/stable/c/43d07103df670484cdd26f9588eabef80f69db89\"}, {\"url\": \"https://git.kernel.org/stable/c/c2ace6300600c634553657785dfe5ea0ed688ac2\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: iwlwifi: read txq-\u003eread_ptr under lock\\n\\nIf we read txq-\u003eread_ptr without lock, we can read the same\\nvalue twice, then obtain the lock, and reclaim from there\\nto two different places, but crucially reclaim the same\\nentry twice, resulting in the WARN_ONCE() a little later.\\nFix that by reading txq-\u003eread_ptr under lock.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.209\", \"versionStartIncluding\": \"4.19\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.175\", \"versionStartIncluding\": \"4.19\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.31\", \"versionStartIncluding\": \"4.19\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8.10\", \"versionStartIncluding\": \"4.19\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9\", \"versionStartIncluding\": \"4.19\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:32:06.118Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-36922\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:32:06.118Z\", \"dateReserved\": \"2024-05-30T15:25:07.068Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-30T15:29:16.852Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.