CVE-2024-47713

wifi: mac80211: use two-phase skb reclamation in ieee80211_do_stop()

Published Oct 21, 2024 CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Description
In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: use two-phase skb reclamation in ieee80211_do_stop()

Since '__dev_queue_xmit()' should be called with interrupts enabled,
the following backtrace:

ieee80211_do_stop()
...
spin_lock_irqsave(&local->queue_stop_reason_lock, flags)
...
ieee80211_free_txskb()
ieee80211_report_used_skb()
ieee80211_report_ack_skb()
cfg80211_mgmt_tx_status_ext()
nl80211_frame_tx_status()
genlmsg_multicast_netns()
genlmsg_multicast_netns_filtered()
nlmsg_multicast_filtered()
netlink_broadcast_filtered()
do_one_broadcast()
netlink_broadcast_deliver()
__netlink_sendskb()
netlink_deliver_tap()
__netlink_deliver_tap_skb()
dev_queue_xmit()
__dev_queue_xmit() ; with IRQS disabled
...
spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags)

issues the warning (as reported by syzbot reproducer):

WARNING: CPU: 2 PID: 5128 at kernel/softirq.c:362 __local_bh_enable_ip+0xc3/0x120

Fix this by implementing a two-phase skb reclamation in
'ieee80211_do_stop()', where actual work is performed
outside of a section with interrupts disabled.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DLA Debian DLA DLA-4008-1 linux-6.1 security update
Debian DLA Debian DLA DLA-4075-1 linux security update
Ubuntu USN Ubuntu USN USN-7166-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-7166-2 Linux kernel (AWS) vulnerabilities
Ubuntu USN Ubuntu USN USN-7166-3 Linux kernel (HWE) vulnerabilities
Ubuntu USN Ubuntu USN USN-7166-4 Linux kernel (Xilinx ZynqMP) vulnerabilities
Ubuntu USN Ubuntu USN USN-7186-1 Linux kernel (Intel IoTG) vulnerabilities
Ubuntu USN Ubuntu USN USN-7186-2 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-7194-1 Linux kernel (Azure) vulnerabilities
Ubuntu USN Ubuntu USN USN-7276-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-7277-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-7293-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-7294-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-7294-2 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-7294-3 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-7294-4 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-7295-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-7301-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-7303-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-7303-2 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-7303-3 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-7304-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-7310-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-7311-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-7384-1 Linux kernel (Azure) vulnerabilities
Ubuntu USN Ubuntu USN USN-7384-2 Linux kernel (Azure) vulnerabilities
Ubuntu USN Ubuntu USN USN-7385-1 Linux kernel (IBM) vulnerabilities
Ubuntu USN Ubuntu USN USN-7386-1 Linux kernel (OEM) vulnerabilities
Ubuntu USN Ubuntu USN USN-7393-1 Linux kernel (FIPS) vulnerabilities
Ubuntu USN Ubuntu USN USN-7401-1 Linux kernel (AWS) vulnerabilities
Ubuntu USN Ubuntu USN USN-7403-1 Linux kernel (HWE) vulnerabilities
Ubuntu USN Ubuntu USN USN-7413-1 Linux kernel (IoT) vulnerabilities
Ubuntu USN Ubuntu USN USN-7468-1 Linux kernel (Azure, N-Series) vulnerabilities
Ubuntu USN Ubuntu USN USN-7539-1 Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN Ubuntu USN USN-7540-1 Linux kernel (Raspberry Pi) vulnerabilities
History
Type Values Removed Values Added
First Time appeared Redhat
Redhat enterprise Linux
CPEs cpe:/a:redhat:enterprise_linux:9
cpe:/o:redhat:enterprise_linux:9
Vendors & Products Redhat
Redhat enterprise Linux
Type Values Removed Values Added
Weaknesses CWE-664
Type Values Removed Values Added
First Time appeared Linux
Linux linux Kernel
Weaknesses NVD-CWE-noinfo
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
Type Values Removed Values Added
References
Metrics threat_severity

None

cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Moderate

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: use two-phase skb reclamation in ieee80211_do_stop() Since '__dev_queue_xmit()' should be called with interrupts enabled, the following backtrace: ieee80211_do_stop() ... spin_lock_irqsave(&local->queue_stop_reason_lock, flags) ... ieee80211_free_txskb() ieee80211_report_used_skb() ieee80211_report_ack_skb() cfg80211_mgmt_tx_status_ext() nl80211_frame_tx_status() genlmsg_multicast_netns() genlmsg_multicast_netns_filtered() nlmsg_multicast_filtered() netlink_broadcast_filtered() do_one_broadcast() netlink_broadcast_deliver() __netlink_sendskb() netlink_deliver_tap() __netlink_deliver_tap_skb() dev_queue_xmit() __dev_queue_xmit() ; with IRQS disabled ... spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags) issues the warning (as reported by syzbot reproducer): WARNING: CPU: 2 PID: 5128 at kernel/softirq.c:362 __local_bh_enable_ip+0xc3/0x120 Fix this by implementing a two-phase skb reclamation in 'ieee80211_do_stop()', where actual work is performed outside of a section with interrupts disabled.
Title wifi: mac80211: use two-phase skb reclamation in ieee80211_do_stop()
References
Weaknesses

Sources

Status
PUBLISHED
Assigner
Linux
Published
Updated
Oct 15, 2026, 12:52 AM
Reserved
Sep 30, 2024, 4:00 PM
Status
Modified
Published
Oct 21, 2024, 12:15 PM
Modified
Oct 15, 2026, 1:18 AM
Severity
Moderate
Public date
Oct 21, 2024, 12:00 AM