CVE-2024-26637

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-26637", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-02-19T14:20:24.137Z", "datePublished": "2024-03-18T10:14:48.378Z", "dateUpdated": "2026-08-05T11:26:26.884Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:26:26.884Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath11k: rely on mac80211 debugfs handling for vif\n\nmac80211 started to delete debugfs entries in certain cases, causing a\nath11k to crash when it tried to delete the entries later. Fix this by\nrelying on mac80211 to delete the entries when appropriate and adding\nthem from the vif_add_debugfs handler."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The stale-dentry free is reached only through local control-plane operations on the wireless netdev \u2014 rtnetlink/nl80211 interface down or delete, MAC/iftype change, or a local system-suspend request \u2014 not from any received 802.11 frame or network packet. No remote or adjacent peer can drive `drv_remove_interface()`.\nAC:L - The failure is deterministic, not a race: once mac80211's `ieee80211_debugfs_recreate_netdev()` has dput the \"twt\" dentry, ath11k's very next `debugfs_remove_recursive(arvif->debugfs_twt)` in the same `drv_remove_interface()` call always operates on freed memory. The attacker needs no specific timing and can pre-shape the dentry slab at leisure before triggering.\nPR:L - `__ieee80211_suspend()` (net/mac80211/pm.c:164) tears every running vif out of the driver whenever WoWLAN is not armed, and suspend is routinely available to an ordinary logged-in local user via systemd-logind/polkit or lid close on ath11k-equipped laptops; the equivalent hotspot-toggle teardown is user-accessible on Android. No CAP_NET_ADMIN is strictly required for that route, so the unprivileged-local case is the correct, higher-severity reading.\nUI:N - The attacker performs the triggering action (suspend request or interface teardown) directly; no separate victim needs to be induced into doing anything.\nS:U - The corruption is confined to kernel memory within the same security authority \u2014 a driver debugfs dentry and whatever kernel slab object reclaims it. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - This is a use-after-free on a freed dentry that debugfs then walks (`d_inode`, `d_subdirs`, `d_fsdata`); if the slab object is reclaimed by a sprayed dentry, `remove_one()`/`__debugfs_file_removed()` dereference attacker-influenced pointers, yielding an arbitrary-read primitive rather than a bounded leak.\nI:H - `simple_recursive_removal()` opens with `dget()`, a lockref write into freed memory, and then `d_invalidate()`/`dput()`s an entire subtree reachable from the reclaimed object \u2014 corrupting refcounts on live filesystem dentries and inodes, which is a standard route to a controlled write and control-flow hijack.\nA:H - Every affected interface teardown reliably oopses the kernel (dereferencing a freed dentry's `d_inode` under `inode_lock()`), and the underflowing `simple_release_fs()` mount count compounds it; a use-after-free of this kind crashes the machine even when not further exploited."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/wireless/ath/ath11k/core.h", "drivers/net/wireless/ath/ath11k/debugfs.c", "drivers/net/wireless/ath/ath11k/debugfs.h", "drivers/net/wireless/ath/ath11k/mac.c"], "versions": [{"version": "0a3d898ee9a8303d5b3982b97ef0703919c3ea76", "lessThan": "aa74ce30a8a40d19a4256de4ae5322e71344a274", "status": "affected", "versionType": "git"}, {"version": "0a3d898ee9a8303d5b3982b97ef0703919c3ea76", "lessThan": "556857aa1d0855aba02b1c63bc52b91ec63fc2cc", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/wireless/ath/ath11k/core.h", "drivers/net/wireless/ath/ath11k/debugfs.c", "drivers/net/wireless/ath/ath11k/debugfs.h", "drivers/net/wireless/ath/ath11k/mac.c"], "versions": [{"version": "6.7", "status": "affected"}, {"version": "0", "lessThan": "6.7", "status": "unaffected", "versionType": "semver"}, {"version": "6.7.3", "lessThanOrEqual": "6.7.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.8", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7", "versionEndExcluding": "6.7.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7", "versionEndExcluding": "6.8"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/aa74ce30a8a40d19a4256de4ae5322e71344a274"}, {"url": "https://git.kernel.org/stable/c/556857aa1d0855aba02b1c63bc52b91ec63fc2cc"}], "title": "wifi: ath11k: rely on mac80211 debugfs handling for vif", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:07:19.812Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/aa74ce30a8a40d19a4256de4ae5322e71344a274", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/556857aa1d0855aba02b1c63bc52b91ec63fc2cc", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-26637", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T15:55:06.774541Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T17:33:16.633Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/aa74ce30a8a40d19a4256de4ae5322e71344a274", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/556857aa1d0855aba02b1c63bc52b91ec63fc2cc", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:07:19.812Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-26637", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T15:55:06.774541Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T12:42:15.879Z"}}], "cna": {"title": "wifi: ath11k: rely on mac80211 debugfs handling for vif", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The stale-dentry free is reached only through local control-plane operations on the wireless netdev \u2014 rtnetlink/nl80211 interface down or delete, MAC/iftype change, or a local system-suspend request \u2014 not from any received 802.11 frame or network packet. No remote or adjacent peer can drive `drv_remove_interface()`.\nAC:L - The failure is deterministic, not a race: once mac80211's `ieee80211_debugfs_recreate_netdev()` has dput the \"twt\" dentry, ath11k's very next `debugfs_remove_recursive(arvif->debugfs_twt)` in the same `drv_remove_interface()` call always operates on freed memory. The attacker needs no specific timing and can pre-shape the dentry slab at leisure before triggering.\nPR:L - `__ieee80211_suspend()` (net/mac80211/pm.c:164) tears every running vif out of the driver whenever WoWLAN is not armed, and suspend is routinely available to an ordinary logged-in local user via systemd-logind/polkit or lid close on ath11k-equipped laptops; the equivalent hotspot-toggle teardown is user-accessible on Android. No CAP_NET_ADMIN is strictly required for that route, so the unprivileged-local case is the correct, higher-severity reading.\nUI:N - The attacker performs the triggering action (suspend request or interface teardown) directly; no separate victim needs to be induced into doing anything.\nS:U - The corruption is confined to kernel memory within the same security authority \u2014 a driver debugfs dentry and whatever kernel slab object reclaims it. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - This is a use-after-free on a freed dentry that debugfs then walks (`d_inode`, `d_subdirs`, `d_fsdata`); if the slab object is reclaimed by a sprayed dentry, `remove_one()`/`__debugfs_file_removed()` dereference attacker-influenced pointers, yielding an arbitrary-read primitive rather than a bounded leak.\nI:H - `simple_recursive_removal()` opens with `dget()`, a lockref write into freed memory, and then `d_invalidate()`/`dput()`s an entire subtree reachable from the reclaimed object \u2014 corrupting refcounts on live filesystem dentries and inodes, which is a standard route to a controlled write and control-flow hijack.\nA:H - Every affected interface teardown reliably oopses the kernel (dereferencing a freed dentry's `d_inode` under `inode_lock()`), and the underflowing `simple_release_fs()` mount count compounds it; a use-after-free of this kind crashes the machine even when not further exploited."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "0a3d898ee9a8303d5b3982b97ef0703919c3ea76", "lessThan": "aa74ce30a8a40d19a4256de4ae5322e71344a274", "versionType": "git"}, {"status": "affected", "version": "0a3d898ee9a8303d5b3982b97ef0703919c3ea76", "lessThan": "556857aa1d0855aba02b1c63bc52b91ec63fc2cc", "versionType": "git"}], "programFiles": ["drivers/net/wireless/ath/ath11k/core.h", "drivers/net/wireless/ath/ath11k/debugfs.c", "drivers/net/wireless/ath/ath11k/debugfs.h", "drivers/net/wireless/ath/ath11k/mac.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.7"}, {"status": "unaffected", "version": "0", "lessThan": "6.7", "versionType": "semver"}, {"status": "unaffected", "version": "6.7.3", "versionType": "semver", "lessThanOrEqual": "6.7.*"}, {"status": "unaffected", "version": "6.8", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/net/wireless/ath/ath11k/core.h", "drivers/net/wireless/ath/ath11k/debugfs.c", "drivers/net/wireless/ath/ath11k/debugfs.h", "drivers/net/wireless/ath/ath11k/mac.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/aa74ce30a8a40d19a4256de4ae5322e71344a274"}, {"url": "https://git.kernel.org/stable/c/556857aa1d0855aba02b1c63bc52b91ec63fc2cc"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath11k: rely on mac80211 debugfs handling for vif\n\nmac80211 started to delete debugfs entries in certain cases, causing a\nath11k to crash when it tried to delete the entries later. Fix this by\nrelying on mac80211 to delete the entries when appropriate and adding\nthem from the vif_add_debugfs handler."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.7.3", "versionStartIncluding": "6.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.8", "versionStartIncluding": "6.7"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:26:26.884Z"}}}, "cveMetadata": {"cveId": "CVE-2024-26637", "state": "PUBLISHED", "dateUpdated": "2026-08-05T11:26:26.884Z", "dateReserved": "2024-02-19T14:20:24.137Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-03-18T10:14:48.378Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/wireless/ath/ath11k/core.h", "drivers/net/wireless/ath/ath11k/debugfs.c", "drivers/net/wireless/ath/ath11k/debugfs.h", "drivers/net/wireless/ath/ath11k/mac.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "aa74ce30a8a40d19a4256de4ae5322e71344a274", "status": "affected", "version": "0a3d898ee9a8303d5b3982b97ef0703919c3ea76", "versionType": "git"}, {"lessThan": "556857aa1d0855aba02b1c63bc52b91ec63fc2cc", "status": "affected", "version": "0a3d898ee9a8303d5b3982b97ef0703919c3ea76", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/wireless/ath/ath11k/core.h", "drivers/net/wireless/ath/ath11k/debugfs.c", "drivers/net/wireless/ath/ath11k/debugfs.h", "drivers/net/wireless/ath/ath11k/mac.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.7"}, {"lessThan": "6.7", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.7.*", "status": "unaffected", "version": "6.7.3", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.8", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "58FD5308-148A-40D3-B36A-0CA6B434A8BF", "versionEndExcluding": "6.7.3", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.8:rc1:*:*:*:*:*:*", "matchCriteriaId": "B9F4EA73-0894-400F-A490-3A397AB7A517", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath11k: rely on mac80211 debugfs handling for vif\n\nmac80211 started to delete debugfs entries in certain cases, causing a\nath11k to crash when it tried to delete the entries later. Fix this by\nrelying on mac80211 to delete the entries when appropriate and adding\nthem from the vif_add_debugfs handler."}, {"lang": "es", "value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: wifi: ath11k: conf\u00eda en el manejo de debugfs de mac80211 para vif mac80211 comenz\u00f3 a eliminar entradas de debugfs en ciertos casos, lo que provoc\u00f3 que ath11k fallara cuando intent\u00f3 eliminar las entradas m\u00e1s tarde. Solucione este problema confiando en mac80211 para eliminar las entradas cuando corresponda y agreg\u00e1ndolas desde el controlador vif_add_debugfs."}], "id": "CVE-2024-26637", "lastModified": "2026-08-04T11:16:51.677", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-26637", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-09-10T15:55:06.774541Z", "version": "2.0.3"}}]}, "published": "2024-03-18T11:15:10.550", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Mailing List", "Patch"], "url": "https://git.kernel.org/stable/c/556857aa1d0855aba02b1c63bc52b91ec63fc2cc"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Mailing List", "Patch"], "url": "https://git.kernel.org/stable/c/aa74ce30a8a40d19a4256de4ae5322e71344a274"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Patch"], "url": "https://git.kernel.org/stable/c/556857aa1d0855aba02b1c63bc52b91ec63fc2cc"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Patch"], "url": "https://git.kernel.org/stable/c/aa74ce30a8a40d19a4256de4ae5322e71344a274"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: wifi: ath11k: rely on mac80211 debugfs handling for vif", "id": "2270106", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2270106"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.4", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-99", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nwifi: ath11k: rely on mac80211 debugfs handling for vif\nmac80211 started to delete debugfs entries in certain cases, causing a\nath11k to crash when it tried to delete the entries later. Fix this by\nrelying on mac80211 to delete the entries when appropriate and adding\nthem from the vif_add_debugfs handler.", "A vulnerability was found in the WiFi driver for ath11k in the Linux kernel, where it caused crashes due to improper handling of debugfs entries. The mac80211 subsystem began deleting these entries under certain conditions, leading to conflicts when ath11k attempted to delete them again, causing system instability and crashes."], "mitigation": {"lang": "en:us", "value": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible."}, "name": "CVE-2024-26637", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-03-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-26637\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-26637\nhttps://lore.kernel.org/linux-cve-announce/20240318101458.2835626-15-lee@kernel.org/T"], "threat_severity": "Moderate"}

{}