CVE-2024-35789

{"dataType": "CVE_RECORD", "cveMetadata": {"cveId": "CVE-2024-35789", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-05-17T12:19:12.338Z", "datePublished": "2024-05-17T12:24:42.323Z", "dateUpdated": "2026-10-15T00:40:48.629Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:29:56.138Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes\n\nWhen moving a station out of a VLAN and deleting the VLAN afterwards, the\nfast_rx entry still holds a pointer to the VLAN's netdev, which can cause\nuse-after-free bugs. Fix this by immediately calling ieee80211_check_fast_rx\nafter the VLAN change."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:A - The stale `fast_rx->dev` is dereferenced in the 802.11 receive fast path (`ieee80211_rx_8023`) when processing a data frame from the affected station, so the attacker must be an associated WiFi client within radio range of the AP. This is link-local 802.11 reachability, not routable network reach, hence Adjacent.\nAC:L - Once the station has been moved out of a VLAN that is subsequently deleted, every subsequent data frame the attacker transmits deterministically dereferences the freed netdev \u2014 there is no race to win and no memory layout the attacker cannot influence. In a hostapd dynamic-VLAN deployment the attacker induces the move itself by reauthenticating into a different RADIUS-assigned VLAN, and can repeat the sequence at will.\nPR:L - `ieee80211_check_fast_rx` only installs a `fast_rx` entry for a station with `WLAN_STA_AUTHORIZED` and a CCMP/GCMP PTK, so the attacker must be an authenticated, authorized client of the WLAN. That is an ordinary low-privileged network user, not an administrator.\nUI:N - No victim action is needed \u2014 the VLAN reassignment and teardown are performed automatically by hostapd in response to the attacker's own (re)authentication, and the attacker's own transmitted frames trigger the dereference.\nS:U - The use-after-free corrupts kernel memory and is exploited within the kernel's own security authority on the AP; there is no hypervisor, IOMMU, or sandbox boundary crossed.\nC:H - The freed `struct net_device` is read for `->tstats`, `->dev_addr` and `->nd_net`, and the skb is delivered into the stack using that stale pointer, so a groomed reclaim yields controlled kernel reads and misdirected traffic delivery; if the slot is reused by a live netdev, the station's frames leak into a different VLAN, defeating the segmentation the VLAN exists to enforce.\nI:H - `dev_sw_netstats_rx_add(fast_rx->dev, skb->len)` reads a per-CPU pointer out of the freed object and writes `rx_bytes += skb->len` (attacker-chosen length) plus `rx_packets++` through it, giving a repeatable, attacker-influenced arbitrary-increment write primitive; combined with the UAF read this is exploitable for control-flow hijacking, and the stale `dev` also permits frame injection into the wrong VLAN.\nA:H - Dereferencing a freed `net_device` from RX softirq context \u2014 including an indirect write through a dangling `->tstats` and passing the freed device to `eth_type_trans`/`netif_receive_skb` \u2014 reliably oopses or panics the access point kernel on the first frame after VLAN teardown."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/mac80211/cfg.c"], "versions": [{"version": "a7f1721684628b8ae6015bca9a176046ee6f30cc", "lessThan": "ea9a0cfc07a7d3601cc680718d9cff0d6927a921", "status": "affected", "versionType": "git"}, {"version": "bd7e90c82850f49c23004d54de14e46d373748a6", "lessThan": "be1dd9254fc115321d6fbee042026d42afc8d931", "status": "affected", "versionType": "git"}, {"version": "cc413b375c6d95e68a4629cb1ba9d099de78ebb9", "lessThan": "e8b067c4058c0121ac8ca71559df8e2e08ff1a7e", "status": "affected", "versionType": "git"}, {"version": "dd0b45538146cb6a54d6da7663b8c3afd16ebcfd", "lessThan": "c8bddbd91bc8e42c961a5e2cec20ab879f21100f", "status": "affected", "versionType": "git"}, {"version": "dd0b45538146cb6a54d6da7663b8c3afd16ebcfd", "lessThan": "7eeabcea79b67cc29563e6a9a5c81f9e2c664d5b", "status": "affected", "versionType": "git"}, {"version": "dd0b45538146cb6a54d6da7663b8c3afd16ebcfd", "lessThan": "6b948b54c8bd620725e0c906e44b10c0b13087a7", "status": "affected", "versionType": "git"}, {"version": "dd0b45538146cb6a54d6da7663b8c3afd16ebcfd", "lessThan": "2884a50f52313a7a911de3afcad065ddbb3d78fc", "status": "affected", "versionType": "git"}, {"version": "dd0b45538146cb6a54d6da7663b8c3afd16ebcfd", "lessThan": "e8678551c0243f799b4859448781cbec1bd6f1cb", "status": "affected", "versionType": "git"}, {"version": "dd0b45538146cb6a54d6da7663b8c3afd16ebcfd", "lessThan": "4f2bdb3c5e3189297e156b3ff84b140423d64685", "status": "affected", "versionType": "git"}, {"version": "22bc2a4814440c4a8979a381f46fec5d224f5c11", "status": "affected", "versionType": "git"}, {"version": "7cfe824f681e1aaac34ea64bb4def8a77801b672", "status": "affected", "versionType": "git"}, {"version": "4.19.189", "lessThan": "4.19.312", "status": "affected", "versionType": "semver"}, {"version": "5.4.114", "lessThan": "5.4.274", "status": "affected", "versionType": "semver"}, {"version": "5.10.32", "lessThan": "5.10.215", "status": "affected", "versionType": "semver"}, {"version": "4.14.232", "lessThan": "4.15", "status": "affected", "versionType": "semver"}, {"version": "5.11.16", "lessThan": "5.12", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/mac80211/cfg.c"], "versions": [{"version": "5.12", "status": "affected"}, {"version": "0", "lessThan": "5.12", "status": "unaffected", "versionType": "semver"}, {"version": "4.19.312", "lessThanOrEqual": "4.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.4.274", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.215", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.154", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.84", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.24", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.7.12", "lessThanOrEqual": "6.7.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.8.3", "lessThanOrEqual": "6.8.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.9", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19.189", "versionEndExcluding": "4.19.312"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4.114", "versionEndExcluding": "5.4.274"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10.32", "versionEndExcluding": "5.10.215"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12", "versionEndExcluding": "5.15.154"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12", "versionEndExcluding": "6.1.84"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12", "versionEndExcluding": "6.6.24"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12", "versionEndExcluding": "6.7.12"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12", "versionEndExcluding": "6.8.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12", "versionEndExcluding": "6.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.14.232"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11.16"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/ea9a0cfc07a7d3601cc680718d9cff0d6927a921"}, {"url": "https://git.kernel.org/stable/c/be1dd9254fc115321d6fbee042026d42afc8d931"}, {"url": "https://git.kernel.org/stable/c/e8b067c4058c0121ac8ca71559df8e2e08ff1a7e"}, {"url": "https://git.kernel.org/stable/c/c8bddbd91bc8e42c961a5e2cec20ab879f21100f"}, {"url": "https://git.kernel.org/stable/c/7eeabcea79b67cc29563e6a9a5c81f9e2c664d5b"}, {"url": "https://git.kernel.org/stable/c/6b948b54c8bd620725e0c906e44b10c0b13087a7"}, {"url": "https://git.kernel.org/stable/c/2884a50f52313a7a911de3afcad065ddbb3d78fc"}, {"url": "https://git.kernel.org/stable/c/e8678551c0243f799b4859448781cbec1bd6f1cb"}, {"url": "https://git.kernel.org/stable/c/4f2bdb3c5e3189297e156b3ff84b140423d64685"}], "title": "wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-35789", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-05-24T14:19:23.131138Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:33:29.281Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:21:47.402Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/ea9a0cfc07a7d3601cc680718d9cff0d6927a921", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/be1dd9254fc115321d6fbee042026d42afc8d931", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/e8b067c4058c0121ac8ca71559df8e2e08ff1a7e", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/c8bddbd91bc8e42c961a5e2cec20ab879f21100f", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/7eeabcea79b67cc29563e6a9a5c81f9e2c664d5b", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/6b948b54c8bd620725e0c906e44b10c0b13087a7", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/2884a50f52313a7a911de3afcad065ddbb3d78fc", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/e8678551c0243f799b4859448781cbec1bd6f1cb", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/4f2bdb3c5e3189297e156b3ff84b140423d64685", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html", "tags": ["x_transferred"]}]}, {"x_adpType": "supplier", "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-10-15T00:40:48.629Z"}, "affected": [{"vendor": "Siemens", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "versions": [{"status": "affected", "version": "0", "lessThan": "V1.1.1", "versionType": "custom"}], "defaultStatus": "unknown"}], "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"}]}]}, "dataVersion": "5.2"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/ea9a0cfc07a7d3601cc680718d9cff0d6927a921", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/be1dd9254fc115321d6fbee042026d42afc8d931", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/e8b067c4058c0121ac8ca71559df8e2e08ff1a7e", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/c8bddbd91bc8e42c961a5e2cec20ab879f21100f", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/7eeabcea79b67cc29563e6a9a5c81f9e2c664d5b", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/6b948b54c8bd620725e0c906e44b10c0b13087a7", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/2884a50f52313a7a911de3afcad065ddbb3d78fc", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/e8678551c0243f799b4859448781cbec1bd6f1cb", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/4f2bdb3c5e3189297e156b3ff84b140423d64685", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:21:47.402Z"}}, {"affected": [{"vendor": "Siemens", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "versions": [{"status": "affected", "version": "0", "lessThan": "V1.1.1", "versionType": "custom"}], "defaultStatus": "unknown"}], "x_adpType": "supplier", "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"}], "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-10-15T00:40:48.629Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-35789", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-05-24T14:19:23.131138Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-24T14:19:27.474Z"}, "title": "CISA ADP Vulnrichment"}], "cna": {"title": "wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:A - The stale `fast_rx->dev` is dereferenced in the 802.11 receive fast path (`ieee80211_rx_8023`) when processing a data frame from the affected station, so the attacker must be an associated WiFi client within radio range of the AP. This is link-local 802.11 reachability, not routable network reach, hence Adjacent.\nAC:L - Once the station has been moved out of a VLAN that is subsequently deleted, every subsequent data frame the attacker transmits deterministically dereferences the freed netdev \u2014 there is no race to win and no memory layout the attacker cannot influence. In a hostapd dynamic-VLAN deployment the attacker induces the move itself by reauthenticating into a different RADIUS-assigned VLAN, and can repeat the sequence at will.\nPR:L - `ieee80211_check_fast_rx` only installs a `fast_rx` entry for a station with `WLAN_STA_AUTHORIZED` and a CCMP/GCMP PTK, so the attacker must be an authenticated, authorized client of the WLAN. That is an ordinary low-privileged network user, not an administrator.\nUI:N - No victim action is needed \u2014 the VLAN reassignment and teardown are performed automatically by hostapd in response to the attacker's own (re)authentication, and the attacker's own transmitted frames trigger the dereference.\nS:U - The use-after-free corrupts kernel memory and is exploited within the kernel's own security authority on the AP; there is no hypervisor, IOMMU, or sandbox boundary crossed.\nC:H - The freed `struct net_device` is read for `->tstats`, `->dev_addr` and `->nd_net`, and the skb is delivered into the stack using that stale pointer, so a groomed reclaim yields controlled kernel reads and misdirected traffic delivery; if the slot is reused by a live netdev, the station's frames leak into a different VLAN, defeating the segmentation the VLAN exists to enforce.\nI:H - `dev_sw_netstats_rx_add(fast_rx->dev, skb->len)` reads a per-CPU pointer out of the freed object and writes `rx_bytes += skb->len` (attacker-chosen length) plus `rx_packets++` through it, giving a repeatable, attacker-influenced arbitrary-increment write primitive; combined with the UAF read this is exploitable for control-flow hijacking, and the stale `dev` also permits frame injection into the wrong VLAN.\nA:H - Dereferencing a freed `net_device` from RX softirq context \u2014 including an indirect write through a dangling `->tstats` and passing the freed device to `eth_type_trans`/`netif_receive_skb` \u2014 reliably oopses or panics the access point kernel on the first frame after VLAN teardown."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "a7f1721684628b8ae6015bca9a176046ee6f30cc", "lessThan": "ea9a0cfc07a7d3601cc680718d9cff0d6927a921", "versionType": "git"}, {"status": "affected", "version": "bd7e90c82850f49c23004d54de14e46d373748a6", "lessThan": "be1dd9254fc115321d6fbee042026d42afc8d931", "versionType": "git"}, {"status": "affected", "version": "cc413b375c6d95e68a4629cb1ba9d099de78ebb9", "lessThan": "e8b067c4058c0121ac8ca71559df8e2e08ff1a7e", "versionType": "git"}, {"status": "affected", "version": "dd0b45538146cb6a54d6da7663b8c3afd16ebcfd", "lessThan": "c8bddbd91bc8e42c961a5e2cec20ab879f21100f", "versionType": "git"}, {"status": "affected", "version": "dd0b45538146cb6a54d6da7663b8c3afd16ebcfd", "lessThan": "7eeabcea79b67cc29563e6a9a5c81f9e2c664d5b", "versionType": "git"}, {"status": "affected", "version": "dd0b45538146cb6a54d6da7663b8c3afd16ebcfd", "lessThan": "6b948b54c8bd620725e0c906e44b10c0b13087a7", "versionType": "git"}, {"status": "affected", "version": "dd0b45538146cb6a54d6da7663b8c3afd16ebcfd", "lessThan": "2884a50f52313a7a911de3afcad065ddbb3d78fc", "versionType": "git"}, {"status": "affected", "version": "dd0b45538146cb6a54d6da7663b8c3afd16ebcfd", "lessThan": "e8678551c0243f799b4859448781cbec1bd6f1cb", "versionType": "git"}, {"status": "affected", "version": "dd0b45538146cb6a54d6da7663b8c3afd16ebcfd", "lessThan": "4f2bdb3c5e3189297e156b3ff84b140423d64685", "versionType": "git"}, {"status": "affected", "version": "22bc2a4814440c4a8979a381f46fec5d224f5c11", "versionType": "git"}, {"status": "affected", "version": "7cfe824f681e1aaac34ea64bb4def8a77801b672", "versionType": "git"}, {"status": "affected", "version": "4.19.189", "lessThan": "4.19.312", "versionType": "semver"}, {"status": "affected", "version": "5.4.114", "lessThan": "5.4.274", "versionType": "semver"}, {"status": "affected", "version": "5.10.32", "lessThan": "5.10.215", "versionType": "semver"}, {"status": "affected", "version": "4.14.232", "lessThan": "4.15", "versionType": "semver"}, {"status": "affected", "version": "5.11.16", "lessThan": "5.12", "versionType": "semver"}], "programFiles": ["net/mac80211/cfg.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.12"}, {"status": "unaffected", "version": "0", "lessThan": "5.12", "versionType": "semver"}, {"status": "unaffected", "version": "4.19.312", "versionType": "semver", "lessThanOrEqual": "4.19.*"}, {"status": "unaffected", "version": "5.4.274", "versionType": "semver", "lessThanOrEqual": "5.4.*"}, {"status": "unaffected", "version": "5.10.215", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.154", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.84", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.24", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.7.12", "versionType": "semver", "lessThanOrEqual": "6.7.*"}, {"status": "unaffected", "version": "6.8.3", "versionType": "semver", "lessThanOrEqual": "6.8.*"}, {"status": "unaffected", "version": "6.9", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/mac80211/cfg.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/ea9a0cfc07a7d3601cc680718d9cff0d6927a921"}, {"url": "https://git.kernel.org/stable/c/be1dd9254fc115321d6fbee042026d42afc8d931"}, {"url": "https://git.kernel.org/stable/c/e8b067c4058c0121ac8ca71559df8e2e08ff1a7e"}, {"url": "https://git.kernel.org/stable/c/c8bddbd91bc8e42c961a5e2cec20ab879f21100f"}, {"url": "https://git.kernel.org/stable/c/7eeabcea79b67cc29563e6a9a5c81f9e2c664d5b"}, {"url": "https://git.kernel.org/stable/c/6b948b54c8bd620725e0c906e44b10c0b13087a7"}, {"url": "https://git.kernel.org/stable/c/2884a50f52313a7a911de3afcad065ddbb3d78fc"}, {"url": "https://git.kernel.org/stable/c/e8678551c0243f799b4859448781cbec1bd6f1cb"}, {"url": "https://git.kernel.org/stable/c/4f2bdb3c5e3189297e156b3ff84b140423d64685"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes\n\nWhen moving a station out of a VLAN and deleting the VLAN afterwards, the\nfast_rx entry still holds a pointer to the VLAN's netdev, which can cause\nuse-after-free bugs. Fix this by immediately calling ieee80211_check_fast_rx\nafter the VLAN change."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.19.312", "versionStartIncluding": "4.19.189"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.4.274", "versionStartIncluding": "5.4.114"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.215", "versionStartIncluding": "5.10.32"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.154", "versionStartIncluding": "5.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.84", "versionStartIncluding": "5.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.24", "versionStartIncluding": "5.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.7.12", "versionStartIncluding": "5.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.8.3", "versionStartIncluding": "5.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.9", "versionStartIncluding": "5.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "4.14.232"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "5.11.16"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:29:56.138Z"}}}, "cveMetadata": {"cveId": "CVE-2024-35789", "state": "PUBLISHED", "dateUpdated": "2026-10-15T00:40:48.629Z", "dateReserved": "2024-05-17T12:19:12.338Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-05-17T12:24:42.323Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/mac80211/cfg.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "ea9a0cfc07a7d3601cc680718d9cff0d6927a921", "status": "affected", "version": "a7f1721684628b8ae6015bca9a176046ee6f30cc", "versionType": "git"}, {"lessThan": "be1dd9254fc115321d6fbee042026d42afc8d931", "status": "affected", "version": "bd7e90c82850f49c23004d54de14e46d373748a6", "versionType": "git"}, {"lessThan": "e8b067c4058c0121ac8ca71559df8e2e08ff1a7e", "status": "affected", "version": "cc413b375c6d95e68a4629cb1ba9d099de78ebb9", "versionType": "git"}, {"lessThan": "c8bddbd91bc8e42c961a5e2cec20ab879f21100f", "status": "affected", "version": "dd0b45538146cb6a54d6da7663b8c3afd16ebcfd", "versionType": "git"}, {"lessThan": "7eeabcea79b67cc29563e6a9a5c81f9e2c664d5b", "status": "affected", "version": "dd0b45538146cb6a54d6da7663b8c3afd16ebcfd", "versionType": "git"}, {"lessThan": "6b948b54c8bd620725e0c906e44b10c0b13087a7", "status": "affected", "version": "dd0b45538146cb6a54d6da7663b8c3afd16ebcfd", "versionType": "git"}, {"lessThan": "2884a50f52313a7a911de3afcad065ddbb3d78fc", "status": "affected", "version": "dd0b45538146cb6a54d6da7663b8c3afd16ebcfd", "versionType": "git"}, {"lessThan": "e8678551c0243f799b4859448781cbec1bd6f1cb", "status": "affected", "version": "dd0b45538146cb6a54d6da7663b8c3afd16ebcfd", "versionType": "git"}, {"lessThan": "4f2bdb3c5e3189297e156b3ff84b140423d64685", "status": "affected", "version": "dd0b45538146cb6a54d6da7663b8c3afd16ebcfd", "versionType": "git"}, {"status": "affected", "version": "22bc2a4814440c4a8979a381f46fec5d224f5c11", "versionType": "git"}, {"status": "affected", "version": "7cfe824f681e1aaac34ea64bb4def8a77801b672", "versionType": "git"}, {"lessThan": "4.19.312", "status": "affected", "version": "4.19.189", "versionType": "semver"}, {"lessThan": "5.4.274", "status": "affected", "version": "5.4.114", "versionType": "semver"}, {"lessThan": "5.10.215", "status": "affected", "version": "5.10.32", "versionType": "semver"}, {"lessThan": "4.15", "status": "affected", "version": "4.14.232", "versionType": "semver"}, {"lessThan": "5.12", "status": "affected", "version": "5.11.16", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/mac80211/cfg.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.12"}, {"lessThan": "5.12", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "4.19.*", "status": "unaffected", "version": "4.19.312", "versionType": "semver"}, {"lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.274", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.215", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.154", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.84", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.24", "versionType": "semver"}, {"lessThanOrEqual": "6.7.*", "status": "unaffected", "version": "6.7.12", "versionType": "semver"}, {"lessThanOrEqual": "6.8.*", "status": "unaffected", "version": "6.8.3", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.9", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"affectedData": [{"defaultStatus": "unknown", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "vendor": "Siemens", "versions": [{"lessThan": "V1.1.1", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "563581F9-6B9B-4F5E-B3EA-D8BB8B19551E", "versionEndExcluding": "4.15", "versionStartIncluding": "4.14.232", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "F7A8056E-6D7E-4E0F-A2B2-F8EBF10FF9FF", "versionEndExcluding": "4.19.312", "versionStartIncluding": "4.19.189", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "64646F81-7DCA-483B-9378-C94B7D86E7C8", "versionEndExcluding": "5.4.274", "versionStartIncluding": "5.4.114", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C2086275-1CDE-450C-A609-98FA1C90F10E", "versionEndExcluding": "5.10.215", "versionStartIncluding": "5.10.32", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "10040772-1DE1-4DA5-91D0-3DDC17BCD2CD", "versionEndExcluding": "5.12", "versionStartIncluding": "5.11.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "79EF2A88-2B19-4725-889C-B6CE14595A85", "versionEndExcluding": "5.15.154", "versionStartIncluding": "5.12.1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "834D9BD5-42A6-4D74-979E-4D6D93F630FD", "versionEndExcluding": "6.1.84", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "8018C1D0-0A5F-48D0-BC72-A2B33FDDA693", "versionEndExcluding": "6.6.24", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "6BE9771A-BAFD-4624-95F9-58D536540C53", "versionEndExcluding": "6.7.12", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "4C59BBC3-6495-4A77-9C82-55EC7CDF5E02", "versionEndExcluding": "6.8.3", "versionStartIncluding": "6.8", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.12:-:*:*:*:*:*:*", "matchCriteriaId": "75EB504D-4A83-4C67-9C8D-FD9C6C8EB4CD", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.12:rc7:*:*:*:*:*:*", "matchCriteriaId": "06AE06A6-A0C3-4556-BFFA-3D6E4BAC43C8", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.12:rc8:*:*:*:*:*:*", "matchCriteriaId": "FCE63934-38CF-4311-AD72-624E86AF3889", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*", "matchCriteriaId": "22BEDD49-2C6D-402D-9DBF-6646F6ECD10B", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*", "matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes\n\nWhen moving a station out of a VLAN and deleting the VLAN afterwards, the\nfast_rx entry still holds a pointer to the VLAN's netdev, which can cause\nuse-after-free bugs. Fix this by immediately calling ieee80211_check_fast_rx\nafter the VLAN change."}, {"lang": "es", "value": " En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: wifi: mac80211: comprobar/borrar fast rx para cambios de VLAN que no sean 4addr sta Al mover una estaci\u00f3n fuera de una VLAN y eliminar la VLAN despu\u00e9s, la entrada fast_rx todav\u00eda contiene un puntero a netdev de la VLAN, lo que puede causar errores de uso despu\u00e9s de la liberaci\u00f3n. Solucione este problema llamando inmediatamente a ieee80211_check_fast_rx despu\u00e9s del cambio de VLAN."}], "id": "CVE-2024-35789", "lastModified": "2026-10-15T01:17:46.277", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-35789", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-05-24T14:19:23.131138Z", "version": "2.0.3"}}]}, "published": "2024-05-17T13:15:58.717", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/2884a50f52313a7a911de3afcad065ddbb3d78fc"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/4f2bdb3c5e3189297e156b3ff84b140423d64685"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/6b948b54c8bd620725e0c906e44b10c0b13087a7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/7eeabcea79b67cc29563e6a9a5c81f9e2c664d5b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/be1dd9254fc115321d6fbee042026d42afc8d931"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c8bddbd91bc8e42c961a5e2cec20ab879f21100f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e8678551c0243f799b4859448781cbec1bd6f1cb"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e8b067c4058c0121ac8ca71559df8e2e08ff1a7e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ea9a0cfc07a7d3601cc680718d9cff0d6927a921"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/2884a50f52313a7a911de3afcad065ddbb3d78fc"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/4f2bdb3c5e3189297e156b3ff84b140423d64685"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/6b948b54c8bd620725e0c906e44b10c0b13087a7"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/7eeabcea79b67cc29563e6a9a5c81f9e2c664d5b"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/be1dd9254fc115321d6fbee042026d42afc8d931"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c8bddbd91bc8e42c961a5e2cec20ab879f21100f"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e8678551c0243f799b4859448781cbec1bd6f1cb"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e8b067c4058c0121ac8ca71559df8e2e08ff1a7e"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ea9a0cfc07a7d3601cc680718d9cff0d6927a921"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"}, {"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2024:4352", "cpe": "cpe:/a:redhat:enterprise_linux:8::nfv", "package": "kernel-rt-0:4.18.0-553.8.1.rt7.349.el8_10", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2024-07-08T00:00:00Z"}, {"advisory": "RHSA-2024:4211", "cpe": "cpe:/o:redhat:enterprise_linux:8", "package": "kernel-0:4.18.0-553.8.1.el8_10", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2024-07-02T00:00:00Z"}, {"advisory": "RHSA-2024:5065", "cpe": "cpe:/o:redhat:rhel_aus:8.6", "package": "kernel-0:4.18.0-372.115.1.el8_6", "product_name": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support", "release_date": "2024-08-07T00:00:00Z"}, {"advisory": "RHSA-2024:5065", "cpe": "cpe:/o:redhat:rhel_tus:8.6", "package": "kernel-0:4.18.0-372.115.1.el8_6", "product_name": "Red Hat Enterprise Linux 8.6 Telecommunications Update Service", "release_date": "2024-08-07T00:00:00Z"}, {"advisory": "RHSA-2024:5065", "cpe": "cpe:/o:redhat:rhel_e4s:8.6", "package": "kernel-0:4.18.0-372.115.1.el8_6", "product_name": "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions", "release_date": "2024-08-07T00:00:00Z"}, {"advisory": "RHSA-2024:6206", "cpe": "cpe:/o:redhat:rhel_eus:8.8", "package": "kernel-0:4.18.0-477.70.1.el8_8", "product_name": "Red Hat Enterprise Linux 8.8 Extended Update Support", "release_date": "2024-09-03T00:00:00Z"}, {"advisory": "RHSA-2024:5363", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "kernel-0:5.14.0-427.31.1.el9_4", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2024-08-15T00:00:00Z"}, {"advisory": "RHSA-2024:5363", "cpe": "cpe:/o:redhat:enterprise_linux:9", "package": "kernel-0:5.14.0-427.31.1.el9_4", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2024-08-15T00:00:00Z"}, {"advisory": "RHSA-2024:5364", "cpe": "cpe:/a:redhat:rhel_eus:9.2", "package": "kernel-0:5.14.0-284.79.1.el9_2", "product_name": "Red Hat Enterprise Linux 9.2 Extended Update Support", "release_date": "2024-08-14T00:00:00Z"}, {"advisory": "RHSA-2024:5365", "cpe": "cpe:/a:redhat:rhel_eus:9.2::nfv", "package": "kernel-rt-0:5.14.0-284.79.1.rt14.364.el9_2", "product_name": "Red Hat Enterprise Linux 9.2 Extended Update Support", "release_date": "2024-08-14T00:00:00Z"}], "bugzilla": {"description": "kernel: wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes", "id": "2281057", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2281057"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "verified"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\nwifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes\nWhen moving a station out of a VLAN and deleting the VLAN afterwards, the\nfast_rx entry still holds a pointer to the VLAN's netdev, which can cause\nuse-after-free bugs. Fix this by immediately calling ieee80211_check_fast_rx\nafter the VLAN change.", "CVE-2024-35789 is a vulnerability in the Linux kernel\u2019s Wi-Fi subsystem (mac80211). It occurs when a station is moved out of a VLAN, and the VLAN is subsequently deleted. A reference to the deleted VLAN\u2019s network device may remain, leading to a use-after-free condition. This can result in system instability or crashes. The issue has been resolved by ensuring that outdated references are cleared when a station changes VLANs."], "name": "CVE-2024-35789", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-05-17T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-35789\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-35789\nhttps://lore.kernel.org/linux-cve-announce/2024051707-CVE-2024-35789-52e5@gregkh/T"], "threat_severity": "Moderate"}

{}