CVE-2024-26666

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-26666", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-02-19T14:20:24.149Z", "datePublished": "2024-04-02T06:22:14.974Z", "dateUpdated": "2026-08-05T11:26:41.038Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:26:41.038Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: fix RCU use in TDLS fast-xmit\n\nThis looks up the link under RCU protection, but isn't\nguaranteed to actually have protection. Fix that."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H", "baseScore": 7.1, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:A - This is mac80211 client-side TDLS/MLO transmit code; both sides of the exposure (AP-MLD link reconfiguration that tears down `sdata->link[]`, and TDLS-peer state/power-save transitions that re-run `ieee80211_check_fast_xmit()`) are driven by 802.11 peers on the same WLAN. Per WiFi guidance this is Adjacent, not Network.\nAC:H - Exploitation requires conditions the attacker cannot influence: an 802.11be MLD association with a TDLS peer on a separately-allocated link (non-MLO stations use the embedded `sdata->deflink`, which is never freed), plus a kernel config where the enclosing `spin_lock_bh(&sta->lock)` does not already imply an RCU read-side section \u2014 on non-preemptible RCU it does, and on PREEMPT_RT `local_bh_disable()` explicitly calls `rcu_read_lock()`, so `synchronize_rcu()` in `ieee80211_tear_down_links()` cannot complete during the window on common configurations.\nPR:N - An over-the-air attacker (rogue/controlled AP MLD triggering link reconfiguration, or a TDLS peer) holds no privileges or account on the victim host. No local credentials or capabilities on the vulnerable system are needed.\nUI:N - Association to the AP MLD and TDLS session setup are performed automatically by the supplicant for configured networks, and the `ieee80211_check_fast_xmit()` triggers (STA authorization, PS transitions, key install, CLEAR_PS_FILT on TX) all occur without any operator action.\nS:U - The unprotected dereference, the freed `link_container`, and any resulting fault all live within the kernel's own security authority. No VM, sandbox, or IOMMU boundary is crossed.\nC:H - Winning the race yields a use-after-free read of the freed `link_container`, and the 6 stale bytes are written into `addr3` of the cached 802.11 header and then transmitted, exposing freed kernel heap contents to any passive sniffer; the fast-xmit cache is rebuilt repeatedly, so the slot can be resampled as it is reallocated to different objects.\nI:L - There is no write to freed memory and no out-of-bounds write \u2014 the only integrity effect is that outbound TDLS frames carry a corrupted BSSID, and on the pre-fix `WARN_ON_ONCE(!link)` path a `hdr_len == 0` cache entry produces malformed frames whose 802.11 header is overwritten by the RFC1042 SNAP.\nA:H - Dereferencing the freed link can oops when the backing slab page has been returned to the allocator or is poisoned under KASAN/KFENCE/SLUB_DEBUG, and the `WARN_ON_ONCE(!link)` on a torn-down link is fatal on the widely-used `panic_on_warn` configurations."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/mac80211/tx.c"], "versions": [{"version": "8cc07265b69141f8ed9597d0f27185239c241c80", "lessThan": "fc3432ae8232ff4025e7c55012dd88db0e3d18eb", "status": "affected", "versionType": "git"}, {"version": "8cc07265b69141f8ed9597d0f27185239c241c80", "lessThan": "c255c3b653c6e8b52ac658c305e2fece2825f7ad", "status": "affected", "versionType": "git"}, {"version": "8cc07265b69141f8ed9597d0f27185239c241c80", "lessThan": "9480adfe4e0f0319b9da04b44e4eebd5ad07e0cd", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/mac80211/tx.c"], "versions": [{"version": "6.5", "status": "affected"}, {"version": "0", "lessThan": "6.5", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.17", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.7.5", "lessThanOrEqual": "6.7.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.8", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5", "versionEndExcluding": "6.6.17"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5", "versionEndExcluding": "6.7.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5", "versionEndExcluding": "6.8"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/fc3432ae8232ff4025e7c55012dd88db0e3d18eb"}, {"url": "https://git.kernel.org/stable/c/c255c3b653c6e8b52ac658c305e2fece2825f7ad"}, {"url": "https://git.kernel.org/stable/c/9480adfe4e0f0319b9da04b44e4eebd5ad07e0cd"}], "title": "wifi: mac80211: fix RCU use in TDLS fast-xmit", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "description": "CWE-noinfo Not enough information"}]}], "affected": [{"vendor": "linux", "product": "linux_kernel", "cpes": ["cpe:2.3:a:linux:linux_kernel:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "8cc07265b691", "status": "affected", "lessThan": "fc3432ae8232", "versionType": "git"}, {"version": "8cc07265b691", "status": "affected", "lessThan": "c255c3b653c6", "versionType": "git"}, {"version": "8cc07265b691", "status": "affected", "lessThan": "9480adfe4e0f", "versionType": "git"}, {"version": "6.5", "status": "affected"}, {"version": "0", "status": "affected", "lessThan": "6.5", "versionType": "custom"}, {"version": "6.6.17", "status": "affected", "lessThanOrEqual": "6.6*", "versionType": "custom"}, {"version": "6.75", "status": "affected", "lessThanOrEqual": "6.7*", "versionType": "custom"}, {"version": "6.8", "status": "affected", "lessThanOrEqual": "*", "versionType": "custom"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-11-04T16:57:36.655308Z", "id": "CVE-2024-26666", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-04T17:03:18.143Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:14:12.542Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/fc3432ae8232ff4025e7c55012dd88db0e3d18eb", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/c255c3b653c6e8b52ac658c305e2fece2825f7ad", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/9480adfe4e0f0319b9da04b44e4eebd5ad07e0cd", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/fc3432ae8232ff4025e7c55012dd88db0e3d18eb", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/c255c3b653c6e8b52ac658c305e2fece2825f7ad", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/9480adfe4e0f0319b9da04b44e4eebd5ad07e0cd", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:14:12.542Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-26666", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-11-04T16:57:36.655308Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:linux:linux_kernel:-:*:*:*:*:*:*:*"], "vendor": "linux", "product": "linux_kernel", "versions": [{"status": "affected", "version": "8cc07265b691", "lessThan": "fc3432ae8232", "versionType": "git"}, {"status": "affected", "version": "8cc07265b691", "lessThan": "c255c3b653c6", "versionType": "git"}, {"status": "affected", "version": "8cc07265b691", "lessThan": "9480adfe4e0f", "versionType": "git"}, {"status": "affected", "version": "6.5"}, {"status": "affected", "version": "0", "lessThan": "6.5", "versionType": "custom"}, {"status": "affected", "version": "6.6.17", "versionType": "custom", "lessThanOrEqual": "6.6*"}, {"status": "affected", "version": "6.75", "versionType": "custom", "lessThanOrEqual": "6.7*"}, {"status": "affected", "version": "6.8", "versionType": "custom", "lessThanOrEqual": "*"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "description": "CWE-noinfo Not enough information"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-23T19:01:21.122Z"}}], "cna": {"title": "wifi: mac80211: fix RCU use in TDLS fast-xmit", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H"}, "scenarios": [{"lang": "en", "value": "AV:A - This is mac80211 client-side TDLS/MLO transmit code; both sides of the exposure (AP-MLD link reconfiguration that tears down `sdata->link[]`, and TDLS-peer state/power-save transitions that re-run `ieee80211_check_fast_xmit()`) are driven by 802.11 peers on the same WLAN. Per WiFi guidance this is Adjacent, not Network.\nAC:H - Exploitation requires conditions the attacker cannot influence: an 802.11be MLD association with a TDLS peer on a separately-allocated link (non-MLO stations use the embedded `sdata->deflink`, which is never freed), plus a kernel config where the enclosing `spin_lock_bh(&sta->lock)` does not already imply an RCU read-side section \u2014 on non-preemptible RCU it does, and on PREEMPT_RT `local_bh_disable()` explicitly calls `rcu_read_lock()`, so `synchronize_rcu()` in `ieee80211_tear_down_links()` cannot complete during the window on common configurations.\nPR:N - An over-the-air attacker (rogue/controlled AP MLD triggering link reconfiguration, or a TDLS peer) holds no privileges or account on the victim host. No local credentials or capabilities on the vulnerable system are needed.\nUI:N - Association to the AP MLD and TDLS session setup are performed automatically by the supplicant for configured networks, and the `ieee80211_check_fast_xmit()` triggers (STA authorization, PS transitions, key install, CLEAR_PS_FILT on TX) all occur without any operator action.\nS:U - The unprotected dereference, the freed `link_container`, and any resulting fault all live within the kernel's own security authority. No VM, sandbox, or IOMMU boundary is crossed.\nC:H - Winning the race yields a use-after-free read of the freed `link_container`, and the 6 stale bytes are written into `addr3` of the cached 802.11 header and then transmitted, exposing freed kernel heap contents to any passive sniffer; the fast-xmit cache is rebuilt repeatedly, so the slot can be resampled as it is reallocated to different objects.\nI:L - There is no write to freed memory and no out-of-bounds write \u2014 the only integrity effect is that outbound TDLS frames carry a corrupted BSSID, and on the pre-fix `WARN_ON_ONCE(!link)` path a `hdr_len == 0` cache entry produces malformed frames whose 802.11 header is overwritten by the RFC1042 SNAP.\nA:H - Dereferencing the freed link can oops when the backing slab page has been returned to the allocator or is poisoned under KASAN/KFENCE/SLUB_DEBUG, and the `WARN_ON_ONCE(!link)` on a torn-down link is fatal on the widely-used `panic_on_warn` configurations."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "8cc07265b69141f8ed9597d0f27185239c241c80", "lessThan": "fc3432ae8232ff4025e7c55012dd88db0e3d18eb", "versionType": "git"}, {"status": "affected", "version": "8cc07265b69141f8ed9597d0f27185239c241c80", "lessThan": "c255c3b653c6e8b52ac658c305e2fece2825f7ad", "versionType": "git"}, {"status": "affected", "version": "8cc07265b69141f8ed9597d0f27185239c241c80", "lessThan": "9480adfe4e0f0319b9da04b44e4eebd5ad07e0cd", "versionType": "git"}], "programFiles": ["net/mac80211/tx.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.5"}, {"status": "unaffected", "version": "0", "lessThan": "6.5", "versionType": "semver"}, {"status": "unaffected", "version": "6.6.17", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.7.5", "versionType": "semver", "lessThanOrEqual": "6.7.*"}, {"status": "unaffected", "version": "6.8", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/mac80211/tx.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/fc3432ae8232ff4025e7c55012dd88db0e3d18eb"}, {"url": "https://git.kernel.org/stable/c/c255c3b653c6e8b52ac658c305e2fece2825f7ad"}, {"url": "https://git.kernel.org/stable/c/9480adfe4e0f0319b9da04b44e4eebd5ad07e0cd"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: fix RCU use in TDLS fast-xmit\n\nThis looks up the link under RCU protection, but isn't\nguaranteed to actually have protection. Fix that."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.17", "versionStartIncluding": "6.5"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.7.5", "versionStartIncluding": "6.5"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.8", "versionStartIncluding": "6.5"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:26:41.038Z"}}}, "cveMetadata": {"cveId": "CVE-2024-26666", "state": "PUBLISHED", "dateUpdated": "2026-08-05T11:26:41.038Z", "dateReserved": "2024-02-19T14:20:24.149Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-04-02T06:22:14.974Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/mac80211/tx.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "fc3432ae8232ff4025e7c55012dd88db0e3d18eb", "status": "affected", "version": "8cc07265b69141f8ed9597d0f27185239c241c80", "versionType": "git"}, {"lessThan": "c255c3b653c6e8b52ac658c305e2fece2825f7ad", "status": "affected", "version": "8cc07265b69141f8ed9597d0f27185239c241c80", "versionType": "git"}, {"lessThan": "9480adfe4e0f0319b9da04b44e4eebd5ad07e0cd", "status": "affected", "version": "8cc07265b69141f8ed9597d0f27185239c241c80", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/mac80211/tx.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.5"}, {"lessThan": "6.5", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.17", "versionType": "semver"}, {"lessThanOrEqual": "6.7.*", "status": "unaffected", "version": "6.7.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.8", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"affectedData": [{"cpes": ["cpe:2.3:a:linux:linux_kernel:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "product": "linux_kernel", "vendor": "linux", "versions": [{"lessThan": "fc3432ae8232", "status": "affected", "version": "8cc07265b691", "versionType": "git"}, {"lessThan": "c255c3b653c6", "status": "affected", "version": "8cc07265b691", "versionType": "git"}, {"lessThan": "9480adfe4e0f", "status": "affected", "version": "8cc07265b691", "versionType": "git"}, {"status": "affected", "version": "6.5"}, {"lessThan": "6.5", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThanOrEqual": "6.6*", "status": "affected", "version": "6.6.17", "versionType": "custom"}, {"lessThanOrEqual": "6.7*", "status": "affected", "version": "6.75", "versionType": "custom"}, {"lessThanOrEqual": "*", "status": "affected", "version": "6.8", "versionType": "custom"}]}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "9A5D5BE4-2D95-4BD6-999E-19600822F2E3", "versionEndExcluding": "6.6.17", "versionStartIncluding": "6.5", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "01925741-2C95-47C1-A7EA-3DC2BB0012D3", "versionEndExcluding": "6.7.5", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.8:rc1:*:*:*:*:*:*", "matchCriteriaId": "B9F4EA73-0894-400F-A490-3A397AB7A517", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.8:rc2:*:*:*:*:*:*", "matchCriteriaId": "056BD938-0A27-4569-B391-30578B309EE3", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.8:rc3:*:*:*:*:*:*", "matchCriteriaId": "F02056A5-B362-4370-9FF8-6F0BD384D520", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: fix RCU use in TDLS fast-xmit\n\nThis looks up the link under RCU protection, but isn't\nguaranteed to actually have protection. Fix that."}, {"lang": "es", "value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: wifi: mac80211: corrige el uso de RCU en TDLS fast-xmit Esto busca el enlace bajo protecci\u00f3n de RCU, pero no se garantiza que realmente tenga protecci\u00f3n. Arregla eso."}], "id": "CVE-2024-26666", "lastModified": "2026-08-04T11:16:55.787", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 5.5, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-26666", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2024-11-04T16:57:36.655308Z", "version": "2.0.3"}}]}, "published": "2024-04-02T07:15:43.500", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/9480adfe4e0f0319b9da04b44e4eebd5ad07e0cd"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c255c3b653c6e8b52ac658c305e2fece2825f7ad"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/fc3432ae8232ff4025e7c55012dd88db0e3d18eb"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/9480adfe4e0f0319b9da04b44e4eebd5ad07e0cd"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c255c3b653c6e8b52ac658c305e2fece2825f7ad"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/fc3432ae8232ff4025e7c55012dd88db0e3d18eb"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: wifi: mac80211: fix RCU use in TDLS fast-xmit", "id": "2272773", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2272773"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\nwifi: mac80211: fix RCU use in TDLS fast-xmit\nThis looks up the link under RCU protection, but isn't\nguaranteed to actually have protection. Fix that.", "A flaw was found in the Linux kernel\u2019s mac80211 subsystem, which handles wireless networking. The issue arises from improper handling of Read-Copy-Update (RCU) in the Tunneled Direct Link Setup (TDLS) fast-xmit function. This flaw can result in using unprotected data structures during execution, leading to potential system instability or exploitation."], "name": "CVE-2024-26666", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Under investigation", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Under investigation", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-04-02T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-26666\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-26666\nhttps://lore.kernel.org/linux-cve-announce/2024040224-CVE-2024-26666-fcfe@gregkh/T"], "statement": "The vulnerability affects certain Linux kernel versions and has been fixed by assuring that the necessary protections are applied during the lookup of wireless links in TDLS.", "threat_severity": "Moderate"}

{}