CVE-2024-26610

{"dataType": "CVE_RECORD", "cveMetadata": {"cveId": "CVE-2024-26610", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-02-19T14:20:24.130Z", "datePublished": "2024-02-29T15:52:15.796Z", "dateUpdated": "2026-08-05T11:26:14.007Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:26:14.007Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: fix a memory corruption\n\niwl_fw_ini_trigger_tlv::data is a pointer to a __le32, which means that\nif we copy to iwl_fw_ini_trigger_tlv::data + offset while offset is in\nbytes, we'll write past the buffer."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The overflowing data comes from debug TLVs parsed out of local files (`iwlwifi-*.ucode` and `iwl-debug-yoyo.bin` in /lib/firmware) during driver/firmware initialization, not from received 802.11 frames or any network input. Reaching the vulnerable merge requires local presence on the system (module/firmware load or the debugfs time-point/clear handlers), so this is Local rather than Adjacent.\nAC:L - The out-of-bounds write is fully deterministic \u2014 whenever two triggers share a time point and the newer one lacks IWL_FW_INI_APPLY_POLICY_OVERRIDE_DATA with non-empty existing data, the byte offset is unconditionally multiplied by four. There is no race, no memory-layout precondition, and INI debug is enabled by default, so no unusual configuration is needed.\nPR:L - Triggering requires only local access to the code path that (re)initializes the iwlwifi firmware debug configuration, with no authentication step in the path itself and no capability check inside iwl_dbg_tlv_override_trig_node. Between low and high privileges this is scored as the higher-severity Low, consistent with other locally-triggered iwlwifi memory-corruption CVEs.\nUI:N - No victim action is required \u2014 the trigger list is merged automatically at IWL_FW_INI_TIME_POINT_EARLY during normal firmware load, which occurs at boot or whenever the device is brought up.\nS:U - The overflow corrupts kernel slab memory and its impact is confined to the kernel's own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The heap overflow writes past the krealloc'd node into adjacent slab objects, corrupting neighbouring kernel structures such as pointers and length fields, which can be leveraged into an arbitrary kernel read primitive and disclosure of arbitrary memory.\nI:H - This is an out-of-bounds heap write of attacker-influenced content whose length (roughly 3 x data_len) and payload both come from the trigger TLV, giving a shaped write into adjacent slab objects \u2014 the standard primitive for kernel data/control-flow corruption and privilege escalation.\nA:H - Slab corruption of adjacent objects reliably produces kernel oopses, allocator BUG_ON/hardened-usercopy panics, or later crashes on freeing the smashed neighbours, resulting in a complete denial of service."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c"], "versions": [{"version": "cf29c5b66b9f83939367d90679eb68cdfa2f0356", "lessThan": "05dd9facfb9a1e056752c0901c6e86416037d15a", "status": "affected", "versionType": "git"}, {"version": "cf29c5b66b9f83939367d90679eb68cdfa2f0356", "lessThan": "99a23462fe1a6f709f0fda3ebbe8b6b193ac75bd", "status": "affected", "versionType": "git"}, {"version": "cf29c5b66b9f83939367d90679eb68cdfa2f0356", "lessThan": "aa2cc9363926991ba74411e3aa0a0ea82c1ffe32", "status": "affected", "versionType": "git"}, {"version": "cf29c5b66b9f83939367d90679eb68cdfa2f0356", "lessThan": "870171899d75d43e3d14360f3a4850e90a9c289b", "status": "affected", "versionType": "git"}, {"version": "cf29c5b66b9f83939367d90679eb68cdfa2f0356", "lessThan": "f32a81999d0b8e5ce60afb5f6a3dd7241c17dd67", "status": "affected", "versionType": "git"}, {"version": "cf29c5b66b9f83939367d90679eb68cdfa2f0356", "lessThan": "cf4a0d840ecc72fcf16198d5e9c505ab7d5a5e4d", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c"], "versions": [{"version": "5.5", "status": "affected"}, {"version": "0", "lessThan": "5.5", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.210", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.149", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.76", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.15", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.7.3", "lessThanOrEqual": "6.7.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.8", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.5", "versionEndExcluding": "5.10.210"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.5", "versionEndExcluding": "5.15.149"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.5", "versionEndExcluding": "6.1.76"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.5", "versionEndExcluding": "6.6.15"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.5", "versionEndExcluding": "6.7.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.5", "versionEndExcluding": "6.8"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/05dd9facfb9a1e056752c0901c6e86416037d15a"}, {"url": "https://git.kernel.org/stable/c/99a23462fe1a6f709f0fda3ebbe8b6b193ac75bd"}, {"url": "https://git.kernel.org/stable/c/aa2cc9363926991ba74411e3aa0a0ea82c1ffe32"}, {"url": "https://git.kernel.org/stable/c/870171899d75d43e3d14360f3a4850e90a9c289b"}, {"url": "https://git.kernel.org/stable/c/f32a81999d0b8e5ce60afb5f6a3dd7241c17dd67"}, {"url": "https://git.kernel.org/stable/c/cf4a0d840ecc72fcf16198d5e9c505ab7d5a5e4d"}], "title": "wifi: iwlwifi: fix a memory corruption", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-26610", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-03-12T18:22:31.931608Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:49:28.637Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:07:19.572Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/05dd9facfb9a1e056752c0901c6e86416037d15a", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/99a23462fe1a6f709f0fda3ebbe8b6b193ac75bd", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/aa2cc9363926991ba74411e3aa0a0ea82c1ffe32", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/870171899d75d43e3d14360f3a4850e90a9c289b", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/f32a81999d0b8e5ce60afb5f6a3dd7241c17dd67", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/cf4a0d840ecc72fcf16198d5e9c505ab7d5a5e4d", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html", "tags": ["x_transferred"]}]}]}, "dataVersion": "5.2"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/05dd9facfb9a1e056752c0901c6e86416037d15a", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/99a23462fe1a6f709f0fda3ebbe8b6b193ac75bd", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/aa2cc9363926991ba74411e3aa0a0ea82c1ffe32", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/870171899d75d43e3d14360f3a4850e90a9c289b", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/f32a81999d0b8e5ce60afb5f6a3dd7241c17dd67", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/cf4a0d840ecc72fcf16198d5e9c505ab7d5a5e4d", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:07:19.572Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-26610", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-03-12T18:22:31.931608Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-23T19:01:17.141Z"}, "title": "CISA ADP Vulnrichment"}], "cna": {"title": "wifi: iwlwifi: fix a memory corruption", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The overflowing data comes from debug TLVs parsed out of local files (`iwlwifi-*.ucode` and `iwl-debug-yoyo.bin` in /lib/firmware) during driver/firmware initialization, not from received 802.11 frames or any network input. Reaching the vulnerable merge requires local presence on the system (module/firmware load or the debugfs time-point/clear handlers), so this is Local rather than Adjacent.\nAC:L - The out-of-bounds write is fully deterministic \u2014 whenever two triggers share a time point and the newer one lacks IWL_FW_INI_APPLY_POLICY_OVERRIDE_DATA with non-empty existing data, the byte offset is unconditionally multiplied by four. There is no race, no memory-layout precondition, and INI debug is enabled by default, so no unusual configuration is needed.\nPR:L - Triggering requires only local access to the code path that (re)initializes the iwlwifi firmware debug configuration, with no authentication step in the path itself and no capability check inside iwl_dbg_tlv_override_trig_node. Between low and high privileges this is scored as the higher-severity Low, consistent with other locally-triggered iwlwifi memory-corruption CVEs.\nUI:N - No victim action is required \u2014 the trigger list is merged automatically at IWL_FW_INI_TIME_POINT_EARLY during normal firmware load, which occurs at boot or whenever the device is brought up.\nS:U - The overflow corrupts kernel slab memory and its impact is confined to the kernel's own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The heap overflow writes past the krealloc'd node into adjacent slab objects, corrupting neighbouring kernel structures such as pointers and length fields, which can be leveraged into an arbitrary kernel read primitive and disclosure of arbitrary memory.\nI:H - This is an out-of-bounds heap write of attacker-influenced content whose length (roughly 3 x data_len) and payload both come from the trigger TLV, giving a shaped write into adjacent slab objects \u2014 the standard primitive for kernel data/control-flow corruption and privilege escalation.\nA:H - Slab corruption of adjacent objects reliably produces kernel oopses, allocator BUG_ON/hardened-usercopy panics, or later crashes on freeing the smashed neighbours, resulting in a complete denial of service."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "cf29c5b66b9f83939367d90679eb68cdfa2f0356", "lessThan": "05dd9facfb9a1e056752c0901c6e86416037d15a", "versionType": "git"}, {"status": "affected", "version": "cf29c5b66b9f83939367d90679eb68cdfa2f0356", "lessThan": "99a23462fe1a6f709f0fda3ebbe8b6b193ac75bd", "versionType": "git"}, {"status": "affected", "version": "cf29c5b66b9f83939367d90679eb68cdfa2f0356", "lessThan": "aa2cc9363926991ba74411e3aa0a0ea82c1ffe32", "versionType": "git"}, {"status": "affected", "version": "cf29c5b66b9f83939367d90679eb68cdfa2f0356", "lessThan": "870171899d75d43e3d14360f3a4850e90a9c289b", "versionType": "git"}, {"status": "affected", "version": "cf29c5b66b9f83939367d90679eb68cdfa2f0356", "lessThan": "f32a81999d0b8e5ce60afb5f6a3dd7241c17dd67", "versionType": "git"}, {"status": "affected", "version": "cf29c5b66b9f83939367d90679eb68cdfa2f0356", "lessThan": "cf4a0d840ecc72fcf16198d5e9c505ab7d5a5e4d", "versionType": "git"}], "programFiles": ["drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.5"}, {"status": "unaffected", "version": "0", "lessThan": "5.5", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.210", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.149", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.76", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.15", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.7.3", "versionType": "semver", "lessThanOrEqual": "6.7.*"}, {"status": "unaffected", "version": "6.8", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/05dd9facfb9a1e056752c0901c6e86416037d15a"}, {"url": "https://git.kernel.org/stable/c/99a23462fe1a6f709f0fda3ebbe8b6b193ac75bd"}, {"url": "https://git.kernel.org/stable/c/aa2cc9363926991ba74411e3aa0a0ea82c1ffe32"}, {"url": "https://git.kernel.org/stable/c/870171899d75d43e3d14360f3a4850e90a9c289b"}, {"url": "https://git.kernel.org/stable/c/f32a81999d0b8e5ce60afb5f6a3dd7241c17dd67"}, {"url": "https://git.kernel.org/stable/c/cf4a0d840ecc72fcf16198d5e9c505ab7d5a5e4d"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: fix a memory corruption\n\niwl_fw_ini_trigger_tlv::data is a pointer to a __le32, which means that\nif we copy to iwl_fw_ini_trigger_tlv::data + offset while offset is in\nbytes, we'll write past the buffer."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.210", "versionStartIncluding": "5.5"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.149", "versionStartIncluding": "5.5"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.76", "versionStartIncluding": "5.5"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.15", "versionStartIncluding": "5.5"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.7.3", "versionStartIncluding": "5.5"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.8", "versionStartIncluding": "5.5"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:26:14.007Z"}}}, "cveMetadata": {"cveId": "CVE-2024-26610", "state": "PUBLISHED", "dateUpdated": "2026-08-05T11:26:14.007Z", "dateReserved": "2024-02-19T14:20:24.130Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-02-29T15:52:15.796Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "05dd9facfb9a1e056752c0901c6e86416037d15a", "status": "affected", "version": "cf29c5b66b9f83939367d90679eb68cdfa2f0356", "versionType": "git"}, {"lessThan": "99a23462fe1a6f709f0fda3ebbe8b6b193ac75bd", "status": "affected", "version": "cf29c5b66b9f83939367d90679eb68cdfa2f0356", "versionType": "git"}, {"lessThan": "aa2cc9363926991ba74411e3aa0a0ea82c1ffe32", "status": "affected", "version": "cf29c5b66b9f83939367d90679eb68cdfa2f0356", "versionType": "git"}, {"lessThan": "870171899d75d43e3d14360f3a4850e90a9c289b", "status": "affected", "version": "cf29c5b66b9f83939367d90679eb68cdfa2f0356", "versionType": "git"}, {"lessThan": "f32a81999d0b8e5ce60afb5f6a3dd7241c17dd67", "status": "affected", "version": "cf29c5b66b9f83939367d90679eb68cdfa2f0356", "versionType": "git"}, {"lessThan": "cf4a0d840ecc72fcf16198d5e9c505ab7d5a5e4d", "status": "affected", "version": "cf29c5b66b9f83939367d90679eb68cdfa2f0356", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.5"}, {"lessThan": "5.5", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.210", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.149", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.76", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.15", "versionType": "semver"}, {"lessThanOrEqual": "6.7.*", "status": "unaffected", "version": "6.7.3", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.8", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "F5CB4CA6-A9A0-4AFD-9102-8CF94D708170", "versionEndExcluding": "5.10.210", "versionStartIncluding": "5.5", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0D0465BB-4053-4E15-9137-6696EBAE90FD", "versionEndExcluding": "5.15.149", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "32F0FEB3-5FE1-4400-A56D-886F09BE872E", "versionEndExcluding": "6.1.76", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "87C718CB-AE3D-4B07-B4D9-BFF64183C468", "versionEndExcluding": "6.6.15", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "58FD5308-148A-40D3-B36A-0CA6B434A8BF", "versionEndExcluding": "6.7.3", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.8:rc1:*:*:*:*:*:*", "matchCriteriaId": "B9F4EA73-0894-400F-A490-3A397AB7A517", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: fix a memory corruption\n\niwl_fw_ini_trigger_tlv::data is a pointer to a __le32, which means that\nif we copy to iwl_fw_ini_trigger_tlv::data + offset while offset is in\nbytes, we'll write past the buffer."}, {"lang": "es", "value": "En el kernel de Linux se ha resuelto la siguiente vulnerabilidad: wifi: iwlwifi: corrige una corrupci\u00f3n de memoria iwl_fw_ini_trigger_tlv::data es un puntero a un __le32, lo que significa que si copiamos a iwl_fw_ini_trigger_tlv::data + offset mientras el offset est\u00e1 en bytes, escribiremos m\u00e1s all\u00e1 del b\u00fafer."}], "id": "CVE-2024-26610", "lastModified": "2026-08-04T11:16:47.840", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-26610", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-03-12T18:22:31.931608Z", "version": "2.0.3"}}]}, "published": "2024-03-11T18:15:19.067", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/05dd9facfb9a1e056752c0901c6e86416037d15a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/870171899d75d43e3d14360f3a4850e90a9c289b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/99a23462fe1a6f709f0fda3ebbe8b6b193ac75bd"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/aa2cc9363926991ba74411e3aa0a0ea82c1ffe32"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/cf4a0d840ecc72fcf16198d5e9c505ab7d5a5e4d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f32a81999d0b8e5ce60afb5f6a3dd7241c17dd67"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/05dd9facfb9a1e056752c0901c6e86416037d15a"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/870171899d75d43e3d14360f3a4850e90a9c289b"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/99a23462fe1a6f709f0fda3ebbe8b6b193ac75bd"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/aa2cc9363926991ba74411e3aa0a0ea82c1ffe32"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/cf4a0d840ecc72fcf16198d5e9c505ab7d5a5e4d"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f32a81999d0b8e5ce60afb5f6a3dd7241c17dd67"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2024:3627", "cpe": "cpe:/a:redhat:enterprise_linux:8::nfv", "package": "kernel-rt-0:4.18.0-553.5.1.rt7.346.el8_10", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2024-06-05T00:00:00Z"}, {"advisory": "RHSA-2024:3618", "cpe": "cpe:/o:redhat:enterprise_linux:8", "package": "kernel-0:4.18.0-553.5.1.el8_10", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2024-06-05T00:00:00Z"}], "bugzilla": {"description": "kernel: wifi: iwlwifi: fix a memory corruption", "id": "2269213", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2269213"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.1", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H", "status": "verified"}, "cwe": "CWE-680", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nwifi: iwlwifi: fix a memory corruption\niwl_fw_ini_trigger_tlv::data is a pointer to a __le32, which means that\nif we copy to iwl_fw_ini_trigger_tlv::data + offset while offset is in\nbytes, we'll write past the buffer.", "A memory corruption flaw was found in the Linux kernel Intel Wireless WiFi Next Gen AGN module. This issue could allow a local user to crash the system."], "mitigation": {"lang": "en:us", "value": "To mitigate this issue, prevent the iwlwifi module from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically."}, "name": "CVE-2024-26610", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-02-29T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-26610\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-26610\nhttps://lore.kernel.org/linux-cve-announce/20240229155245.1571576-42-lee@kernel.org/T"], "statement": "Red Hat Enterprise Linux 9 is not affected by this vulnerability.", "threat_severity": "Moderate"}

{}