CVE-2024-40911 (GCVE-0-2024-40911)
Vulnerability from cvelistv5
Published
2024-07-12 12:20
Modified
2026-08-05 11:33
Severity ?
8.8 (High) - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: Lock wiphy in cfg80211_get_station Wiphy should be locked before calling rdev_get_station() (see lockdep assert in ieee80211_get_station()). This fixes the following kernel NULL dereference: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000050 Mem abort info: ESR = 0x0000000096000006 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x06: level 2 translation fault Data abort info: ISV = 0, ISS = 0x00000006 CM = 0, WnR = 0 user pgtable: 4k pages, 48-bit VAs, pgdp=0000000003001000 [0000000000000050] pgd=0800000002dca003, p4d=0800000002dca003, pud=08000000028e9003, pmd=0000000000000000 Internal error: Oops: 0000000096000006 [#1] SMP Modules linked in: netconsole dwc3_meson_g12a dwc3_of_simple dwc3 ip_gre gre ath10k_pci ath10k_core ath9k ath9k_common ath9k_hw ath CPU: 0 PID: 1091 Comm: kworker/u8:0 Not tainted 6.4.0-02144-g565f9a3a7911-dirty #705 Hardware name: RPT (r1) (DT) Workqueue: bat_events batadv_v_elp_throughput_metric_update pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : ath10k_sta_statistics+0x10/0x2dc [ath10k_core] lr : sta_set_sinfo+0xcc/0xbd4 sp : ffff000007b43ad0 x29: ffff000007b43ad0 x28: ffff0000071fa900 x27: ffff00000294ca98 x26: ffff000006830880 x25: ffff000006830880 x24: ffff00000294c000 x23: 0000000000000001 x22: ffff000007b43c90 x21: ffff800008898acc x20: ffff00000294c6e8 x19: ffff000007b43c90 x18: 0000000000000000 x17: 445946354d552d78 x16: 62661f7200000000 x15: 57464f445946354d x14: 0000000000000000 x13: 00000000000000e3 x12: d5f0acbcebea978e x11: 00000000000000e3 x10: 000000010048fe41 x9 : 0000000000000000 x8 : ffff000007b43d90 x7 : 000000007a1e2125 x6 : 0000000000000000 x5 : ffff0000024e0900 x4 : ffff800000a0250c x3 : ffff000007b43c90 x2 : ffff00000294ca98 x1 : ffff000006831920 x0 : 0000000000000000 Call trace: ath10k_sta_statistics+0x10/0x2dc [ath10k_core] sta_set_sinfo+0xcc/0xbd4 ieee80211_get_station+0x2c/0x44 cfg80211_get_station+0x80/0x154 batadv_v_elp_get_throughput+0x138/0x1fc batadv_v_elp_throughput_metric_update+0x1c/0xa4 process_one_work+0x1ec/0x414 worker_thread+0x70/0x46c kthread+0xdc/0xe0 ret_from_fork+0x10/0x20 Code: a9bb7bfd 910003fd a90153f3 f9411c40 (f9402814) This happens because STA has time to disconnect and reconnect before batadv_v_elp_throughput_metric_update() delayed work gets scheduled. In this situation, ath10k_sta_state() can be in the middle of resetting arsta data when the work queue get chance to be scheduled and ends up accessing it. Locking wiphy prevents that.
References
Impacted products
Vendor Product Version
Linux Linux Version: 7406353d43c8e2faf478721e87aeb6f2f9685de0
Version: 7406353d43c8e2faf478721e87aeb6f2f9685de0
Version: 7406353d43c8e2faf478721e87aeb6f2f9685de0
Version: 7406353d43c8e2faf478721e87aeb6f2f9685de0
Version: 7406353d43c8e2faf478721e87aeb6f2f9685de0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T21:57:40.593Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/dfd84ce41663be9ca3f69bd657c45f49b69344d9"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/6d540b0317901535275020bd4ac44fac6439ca76"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/0ccc63958d8373e15a69f4f8069f3e78f7f3898a"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/43e1eefb0b2094e2281150d87d09e8bc872b9fba"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/642f89daa34567d02f312d03e41523a894906dae"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-40911",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T17:06:02.658686Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:34:37.167Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/wireless/util.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "dfd84ce41663be9ca3f69bd657c45f49b69344d9",
              "status": "affected",
              "version": "7406353d43c8e2faf478721e87aeb6f2f9685de0",
              "versionType": "git"
            },
            {
              "lessThan": "6d540b0317901535275020bd4ac44fac6439ca76",
              "status": "affected",
              "version": "7406353d43c8e2faf478721e87aeb6f2f9685de0",
              "versionType": "git"
            },
            {
              "lessThan": "0ccc63958d8373e15a69f4f8069f3e78f7f3898a",
              "status": "affected",
              "version": "7406353d43c8e2faf478721e87aeb6f2f9685de0",
              "versionType": "git"
            },
            {
              "lessThan": "43e1eefb0b2094e2281150d87d09e8bc872b9fba",
              "status": "affected",
              "version": "7406353d43c8e2faf478721e87aeb6f2f9685de0",
              "versionType": "git"
            },
            {
              "lessThan": "642f89daa34567d02f312d03e41523a894906dae",
              "status": "affected",
              "version": "7406353d43c8e2faf478721e87aeb6f2f9685de0",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/wireless/util.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.16"
            },
            {
              "lessThan": "3.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.162",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.95",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.10",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.162",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.95",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.35",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9.6",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: Lock wiphy in cfg80211_get_station\n\nWiphy should be locked before calling rdev_get_station() (see lockdep\nassert in ieee80211_get_station()).\n\nThis fixes the following kernel NULL dereference:\n\n Unable to handle kernel NULL pointer dereference at virtual address 0000000000000050\n Mem abort info:\n   ESR = 0x0000000096000006\n   EC = 0x25: DABT (current EL), IL = 32 bits\n   SET = 0, FnV = 0\n   EA = 0, S1PTW = 0\n   FSC = 0x06: level 2 translation fault\n Data abort info:\n   ISV = 0, ISS = 0x00000006\n   CM = 0, WnR = 0\n user pgtable: 4k pages, 48-bit VAs, pgdp=0000000003001000\n [0000000000000050] pgd=0800000002dca003, p4d=0800000002dca003, pud=08000000028e9003, pmd=0000000000000000\n Internal error: Oops: 0000000096000006 [#1] SMP\n Modules linked in: netconsole dwc3_meson_g12a dwc3_of_simple dwc3 ip_gre gre ath10k_pci ath10k_core ath9k ath9k_common ath9k_hw ath\n CPU: 0 PID: 1091 Comm: kworker/u8:0 Not tainted 6.4.0-02144-g565f9a3a7911-dirty #705\n Hardware name: RPT (r1) (DT)\n Workqueue: bat_events batadv_v_elp_throughput_metric_update\n pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n pc : ath10k_sta_statistics+0x10/0x2dc [ath10k_core]\n lr : sta_set_sinfo+0xcc/0xbd4\n sp : ffff000007b43ad0\n x29: ffff000007b43ad0 x28: ffff0000071fa900 x27: ffff00000294ca98\n x26: ffff000006830880 x25: ffff000006830880 x24: ffff00000294c000\n x23: 0000000000000001 x22: ffff000007b43c90 x21: ffff800008898acc\n x20: ffff00000294c6e8 x19: ffff000007b43c90 x18: 0000000000000000\n x17: 445946354d552d78 x16: 62661f7200000000 x15: 57464f445946354d\n x14: 0000000000000000 x13: 00000000000000e3 x12: d5f0acbcebea978e\n x11: 00000000000000e3 x10: 000000010048fe41 x9 : 0000000000000000\n x8 : ffff000007b43d90 x7 : 000000007a1e2125 x6 : 0000000000000000\n x5 : ffff0000024e0900 x4 : ffff800000a0250c x3 : ffff000007b43c90\n x2 : ffff00000294ca98 x1 : ffff000006831920 x0 : 0000000000000000\n Call trace:\n  ath10k_sta_statistics+0x10/0x2dc [ath10k_core]\n  sta_set_sinfo+0xcc/0xbd4\n  ieee80211_get_station+0x2c/0x44\n  cfg80211_get_station+0x80/0x154\n  batadv_v_elp_get_throughput+0x138/0x1fc\n  batadv_v_elp_throughput_metric_update+0x1c/0xa4\n  process_one_work+0x1ec/0x414\n  worker_thread+0x70/0x46c\n  kthread+0xdc/0xe0\n  ret_from_fork+0x10/0x20\n Code: a9bb7bfd 910003fd a90153f3 f9411c40 (f9402814)\n\nThis happens because STA has time to disconnect and reconnect before\nbatadv_v_elp_throughput_metric_update() delayed work gets scheduled. In\nthis situation, ath10k_sta_state() can be in the middle of resetting\narsta data when the work queue get chance to be scheduled and ends up\naccessing it. Locking wiphy prevents that."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The vulnerable path is only reachable via batman-adv\u0027s ELP throughput worker querying a WiFi neighbour, and the race window is opened by that neighbour\u0027s 802.11 disassociation/reassociation. This requires the attacker to be a link-layer WiFi peer of the mesh node, i.e. within radio range on the same segment.\nAC:L - The attacker directly controls one side of the race by repeatedly disconnecting and reconnecting, which is precisely what triggers ath10k_sta_state()\u0027s memset(arsta) / sta_info teardown, while the ELP metric worker fires on a fixed ~500ms interval per neighbour and can be hit by simple repetition. The commit message confirms the race occurs even in ordinary operation without any attacker effort.\nPR:N - The attacker is a WiFi peer with no privileges or account on the victim mesh node, and batman-adv\u0027s typical deployments (community mesh, IBSS/802.11s links) are frequently unauthenticated/open. Being an ELP neighbour confers no privilege on the vulnerable system itself.\nUI:N - The batman-adv ELP worker polls neighbour throughput automatically on a timer with no operator involvement. The attacker only has to associate and drop the link.\nS:U - The corruption and crash occur entirely within the kernel of the affected mesh node, with no crossing of a virtualization, IOMMU, or sandbox boundary. Impact stays within the same security authority.\nC:H - Because neither the wiphy mutex nor an RCU read section is held, sta_info_get_bss() hands back a pointer that __sta_info_destroy_part2()/sta_info_free() can kfree() concurrently, so sta_set_sinfo() and the driver sta_statistics callback read a freed struct sta_info and chase its embedded pointers. A use-after-free read of a heap object whose contents the attacker can groom by reassociating yields an arbitrary-read primitive.\nI:H - The same use-after-free lets the attacker control the reallocated object\u0027s contents, and the driver callback dereferences pointers taken from it (e.g. arsta-\u003earvif-\u003ear and driver ops), giving a corruption/control-flow primitive. Per kernel scoring guidance, use-after-free and type-confusion of a freed structure are treated as High integrity impact.\nA:H - The reported and reproducible outcome is a kernel NULL pointer dereference oops in ath10k_sta_statistics(), panicking the mesh node. The attacker can retrigger it at will by cycling association, giving persistent denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:33:58.834Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/dfd84ce41663be9ca3f69bd657c45f49b69344d9"
        },
        {
          "url": "https://git.kernel.org/stable/c/6d540b0317901535275020bd4ac44fac6439ca76"
        },
        {
          "url": "https://git.kernel.org/stable/c/0ccc63958d8373e15a69f4f8069f3e78f7f3898a"
        },
        {
          "url": "https://git.kernel.org/stable/c/43e1eefb0b2094e2281150d87d09e8bc872b9fba"
        },
        {
          "url": "https://git.kernel.org/stable/c/642f89daa34567d02f312d03e41523a894906dae"
        }
      ],
      "title": "wifi: cfg80211: Lock wiphy in cfg80211_get_station",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-40911",
    "datePublished": "2024-07-12T12:20:49.796Z",
    "dateReserved": "2024-07-12T12:17:45.580Z",
    "dateUpdated": "2026-08-05T11:33:58.834Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/dfd84ce41663be9ca3f69bd657c45f49b69344d9\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/6d540b0317901535275020bd4ac44fac6439ca76\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/0ccc63958d8373e15a69f4f8069f3e78f7f3898a\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/43e1eefb0b2094e2281150d87d09e8bc872b9fba\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/642f89daa34567d02f312d03e41523a894906dae\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T21:57:40.593Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-40911\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T17:06:02.658686Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:24.837Z\"}}], \"cna\": {\"title\": \"wifi: cfg80211: Lock wiphy in cfg80211_get_station\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"7406353d43c8e2faf478721e87aeb6f2f9685de0\", \"lessThan\": \"dfd84ce41663be9ca3f69bd657c45f49b69344d9\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"7406353d43c8e2faf478721e87aeb6f2f9685de0\", \"lessThan\": \"6d540b0317901535275020bd4ac44fac6439ca76\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"7406353d43c8e2faf478721e87aeb6f2f9685de0\", \"lessThan\": \"0ccc63958d8373e15a69f4f8069f3e78f7f3898a\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"7406353d43c8e2faf478721e87aeb6f2f9685de0\", \"lessThan\": \"43e1eefb0b2094e2281150d87d09e8bc872b9fba\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"7406353d43c8e2faf478721e87aeb6f2f9685de0\", \"lessThan\": \"642f89daa34567d02f312d03e41523a894906dae\", \"versionType\": \"git\"}], \"programFiles\": [\"net/wireless/util.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"3.16\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"3.16\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.15.162\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.95\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.35\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9.6\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.9.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"net/wireless/util.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/dfd84ce41663be9ca3f69bd657c45f49b69344d9\"}, {\"url\": \"https://git.kernel.org/stable/c/6d540b0317901535275020bd4ac44fac6439ca76\"}, {\"url\": \"https://git.kernel.org/stable/c/0ccc63958d8373e15a69f4f8069f3e78f7f3898a\"}, {\"url\": \"https://git.kernel.org/stable/c/43e1eefb0b2094e2281150d87d09e8bc872b9fba\"}, {\"url\": \"https://git.kernel.org/stable/c/642f89daa34567d02f312d03e41523a894906dae\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: cfg80211: Lock wiphy in cfg80211_get_station\\n\\nWiphy should be locked before calling rdev_get_station() (see lockdep\\nassert in ieee80211_get_station()).\\n\\nThis fixes the following kernel NULL dereference:\\n\\n Unable to handle kernel NULL pointer dereference at virtual address 0000000000000050\\n Mem abort info:\\n   ESR = 0x0000000096000006\\n   EC = 0x25: DABT (current EL), IL = 32 bits\\n   SET = 0, FnV = 0\\n   EA = 0, S1PTW = 0\\n   FSC = 0x06: level 2 translation fault\\n Data abort info:\\n   ISV = 0, ISS = 0x00000006\\n   CM = 0, WnR = 0\\n user pgtable: 4k pages, 48-bit VAs, pgdp=0000000003001000\\n [0000000000000050] pgd=0800000002dca003, p4d=0800000002dca003, pud=08000000028e9003, pmd=0000000000000000\\n Internal error: Oops: 0000000096000006 [#1] SMP\\n Modules linked in: netconsole dwc3_meson_g12a dwc3_of_simple dwc3 ip_gre gre ath10k_pci ath10k_core ath9k ath9k_common ath9k_hw ath\\n CPU: 0 PID: 1091 Comm: kworker/u8:0 Not tainted 6.4.0-02144-g565f9a3a7911-dirty #705\\n Hardware name: RPT (r1) (DT)\\n Workqueue: bat_events batadv_v_elp_throughput_metric_update\\n pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\\n pc : ath10k_sta_statistics+0x10/0x2dc [ath10k_core]\\n lr : sta_set_sinfo+0xcc/0xbd4\\n sp : ffff000007b43ad0\\n x29: ffff000007b43ad0 x28: ffff0000071fa900 x27: ffff00000294ca98\\n x26: ffff000006830880 x25: ffff000006830880 x24: ffff00000294c000\\n x23: 0000000000000001 x22: ffff000007b43c90 x21: ffff800008898acc\\n x20: ffff00000294c6e8 x19: ffff000007b43c90 x18: 0000000000000000\\n x17: 445946354d552d78 x16: 62661f7200000000 x15: 57464f445946354d\\n x14: 0000000000000000 x13: 00000000000000e3 x12: d5f0acbcebea978e\\n x11: 00000000000000e3 x10: 000000010048fe41 x9 : 0000000000000000\\n x8 : ffff000007b43d90 x7 : 000000007a1e2125 x6 : 0000000000000000\\n x5 : ffff0000024e0900 x4 : ffff800000a0250c x3 : ffff000007b43c90\\n x2 : ffff00000294ca98 x1 : ffff000006831920 x0 : 0000000000000000\\n Call trace:\\n  ath10k_sta_statistics+0x10/0x2dc [ath10k_core]\\n  sta_set_sinfo+0xcc/0xbd4\\n  ieee80211_get_station+0x2c/0x44\\n  cfg80211_get_station+0x80/0x154\\n  batadv_v_elp_get_throughput+0x138/0x1fc\\n  batadv_v_elp_throughput_metric_update+0x1c/0xa4\\n  process_one_work+0x1ec/0x414\\n  worker_thread+0x70/0x46c\\n  kthread+0xdc/0xe0\\n  ret_from_fork+0x10/0x20\\n Code: a9bb7bfd 910003fd a90153f3 f9411c40 (f9402814)\\n\\nThis happens because STA has time to disconnect and reconnect before\\nbatadv_v_elp_throughput_metric_update() delayed work gets scheduled. In\\nthis situation, ath10k_sta_state() can be in the middle of resetting\\narsta data when the work queue get chance to be scheduled and ends up\\naccessing it. Locking wiphy prevents that.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.162\", \"versionStartIncluding\": \"3.16\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.95\", \"versionStartIncluding\": \"3.16\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.35\", \"versionStartIncluding\": \"3.16\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9.6\", \"versionStartIncluding\": \"3.16\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10\", \"versionStartIncluding\": \"3.16\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-11T20:22:12.729Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-40911\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-11T20:22:12.729Z\", \"dateReserved\": \"2024-07-12T12:17:45.580Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-07-12T12:20:49.796Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.