Vulnerability-Lookup

GHSA-CHMJ-69Q7-QHGF

Vulnerability from github – Published: 2024-03-18 12:30 – Updated: 2025-03-10 18:31

Details

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath11k: rely on mac80211 debugfs handling for vif

mac80211 started to delete debugfs entries in certain cases, causing a ath11k to crash when it tried to delete the entries later. Fix this by relying on mac80211 to delete the entries when appropriate and adding them from the vif_add_debugfs handler.

Severity

5.5 (Medium)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-26637"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-03-18T11:15:10Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath11k: rely on mac80211 debugfs handling for vif\n\nmac80211 started to delete debugfs entries in certain cases, causing a\nath11k to crash when it tried to delete the entries later. Fix this by\nrelying on mac80211 to delete the entries when appropriate and adding\nthem from the vif_add_debugfs handler.",
  "id": "GHSA-chmj-69q7-qhgf",
  "modified": "2025-03-10T18:31:49Z",
  "published": "2024-03-18T12:30:35Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-26637"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/556857aa1d0855aba02b1c63bc52b91ec63fc2cc"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/aa74ce30a8a40d19a4256de4ae5322e71344a274"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2024-26637 (GCVE-0-2024-26637)

Vulnerability from cvelistv5 – Published: 2024-03-18 10:14 – Updated: 2026-08-05 11:26

Title

wifi: ath11k: rely on mac80211 debugfs handling for vif

Summary

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: rely on mac80211 debugfs handling for vif mac80211 started to delete debugfs entries in certain cases, causing a ath11k to crash when it tried to delete the entries later. Fix this by relying on mac80211 to delete the entries when appropriate and adding them from the vif_add_debugfs handler.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-09-10 15:55 UTC

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6856 records in the last 180 days details

References

2 references

URL	Tags
https://git.kernel.org/stable/c/aa74ce30a8a40d19a…
https://git.kernel.org/stable/c/556857aa1d0855aba…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 0a3d898ee9a8303d5b3982b97ef0703919c3ea76 , < aa74ce30a8a40d19a4256de4ae5322e71344a274 (git) Affected: 0a3d898ee9a8303d5b3982b97ef0703919c3ea76 , < 556857aa1d0855aba02b1c63bc52b91ec63fc2cc (git)
Linux	Linux	Affected: 6.7 Unaffected: 0 , < 6.7 (semver) Unaffected: 6.7.3 , ≤ 6.7.* (semver) Unaffected: 6.8 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:07:19.812Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/aa74ce30a8a40d19a4256de4ae5322e71344a274"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/556857aa1d0855aba02b1c63bc52b91ec63fc2cc"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-26637",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:55:06.774541Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:33:16.633Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/ath/ath11k/core.h",
            "drivers/net/wireless/ath/ath11k/debugfs.c",
            "drivers/net/wireless/ath/ath11k/debugfs.h",
            "drivers/net/wireless/ath/ath11k/mac.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "aa74ce30a8a40d19a4256de4ae5322e71344a274",
              "status": "affected",
              "version": "0a3d898ee9a8303d5b3982b97ef0703919c3ea76",
              "versionType": "git"
            },
            {
              "lessThan": "556857aa1d0855aba02b1c63bc52b91ec63fc2cc",
              "status": "affected",
              "version": "0a3d898ee9a8303d5b3982b97ef0703919c3ea76",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/ath/ath11k/core.h",
            "drivers/net/wireless/ath/ath11k/debugfs.c",
            "drivers/net/wireless/ath/ath11k/debugfs.h",
            "drivers/net/wireless/ath/ath11k/mac.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.7"
            },
            {
              "lessThan": "6.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.3",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath11k: rely on mac80211 debugfs handling for vif\n\nmac80211 started to delete debugfs entries in certain cases, causing a\nath11k to crash when it tried to delete the entries later. Fix this by\nrelying on mac80211 to delete the entries when appropriate and adding\nthem from the vif_add_debugfs handler."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The stale-dentry free is reached only through local control-plane operations on the wireless netdev \u2014 rtnetlink/nl80211 interface down or delete, MAC/iftype change, or a local system-suspend request \u2014 not from any received 802.11 frame or network packet. No remote or adjacent peer can drive `drv_remove_interface()`.\nAC:L - The failure is deterministic, not a race: once mac80211\u0027s `ieee80211_debugfs_recreate_netdev()` has dput the \"twt\" dentry, ath11k\u0027s very next `debugfs_remove_recursive(arvif-\u003edebugfs_twt)` in the same `drv_remove_interface()` call always operates on freed memory. The attacker needs no specific timing and can pre-shape the dentry slab at leisure before triggering.\nPR:L - `__ieee80211_suspend()` (net/mac80211/pm.c:164) tears every running vif out of the driver whenever WoWLAN is not armed, and suspend is routinely available to an ordinary logged-in local user via systemd-logind/polkit or lid close on ath11k-equipped laptops; the equivalent hotspot-toggle teardown is user-accessible on Android. No CAP_NET_ADMIN is strictly required for that route, so the unprivileged-local case is the correct, higher-severity reading.\nUI:N - The attacker performs the triggering action (suspend request or interface teardown) directly; no separate victim needs to be induced into doing anything.\nS:U - The corruption is confined to kernel memory within the same security authority \u2014 a driver debugfs dentry and whatever kernel slab object reclaims it. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - This is a use-after-free on a freed dentry that debugfs then walks (`d_inode`, `d_subdirs`, `d_fsdata`); if the slab object is reclaimed by a sprayed dentry, `remove_one()`/`__debugfs_file_removed()` dereference attacker-influenced pointers, yielding an arbitrary-read primitive rather than a bounded leak.\nI:H - `simple_recursive_removal()` opens with `dget()`, a lockref write into freed memory, and then `d_invalidate()`/`dput()`s an entire subtree reachable from the reclaimed object \u2014 corrupting refcounts on live filesystem dentries and inodes, which is a standard route to a controlled write and control-flow hijack.\nA:H - Every affected interface teardown reliably oopses the kernel (dereferencing a freed dentry\u0027s `d_inode` under `inode_lock()`), and the underflowing `simple_release_fs()` mount count compounds it; a use-after-free of this kind crashes the machine even when not further exploited."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:26:26.884Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/aa74ce30a8a40d19a4256de4ae5322e71344a274"
        },
        {
          "url": "https://git.kernel.org/stable/c/556857aa1d0855aba02b1c63bc52b91ec63fc2cc"
        }
      ],
      "title": "wifi: ath11k: rely on mac80211 debugfs handling for vif",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26637",
    "datePublished": "2024-03-18T10:14:48.378Z",
    "dateReserved": "2024-02-19T14:20:24.137Z",
    "dateUpdated": "2026-08-05T11:26:26.884Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted