cbcvebase.
CVE-2024-26896
published 2024-04-17

CVE-2024-26896: In the Linux kernel, the following vulnerability has been resolved: wifi: wfx: fix memory leak when starting AP Kmemleak reported this error: unreferenced…

PriorityP418medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.22%
13.2th percentile
In the Linux kernel, the following vulnerability has been resolved: wifi: wfx: fix memory leak when starting AP Kmemleak reported this error: unreferenced object 0xd73d1180 (size 184): comm "wpa_supplicant", pid 1559, jiffies 13006305 (age 964.245s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 1e 00 01 00 00 00 00 00 ................ backtrace: [] kmem_cache_alloc+0x20c/0x5ac [] __alloc_skb+0x144/0x170 [] __netdev_alloc_skb+0x50/0x180 [] __ieee80211_beacon_get+0x290/0x4d4 [mac80211] [] ieee80211_beacon_get_tim+0x54/0x18c [mac80211] [] wfx_start_ap+0xc8/0x234 [wfx] [] ieee80211_start_ap+0x404/0x6b4 [mac80211] [] nl80211_start_ap+0x76c/0x9e0 [cfg80211] [] genl_rcv_msg+0x198/0x378 [] netlink_rcv_skb+0xd0/0x130 [] genl_rcv+0x34/0x44 [] netlink_unicast+0x1b4/0x258 [] netlink_sendmsg+0x1e8/0x428 [] ____sys_sendmsg+0x1e0/0x274 [] ___sys_sendmsg+0x80/0xb4 [] __sys_sendmsg+0x64/0xa8 unreferenced object 0xce087000 (size 1024): comm "wpa_supplicant", pid 1559, jiffies 13006305 (age 964.246s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 10 00 07 40 00 00 00 00 00 00 00 00 00 00 00 00 ...@............ backtrace: [] __kmalloc_track_caller+0x230/0x600 [] kmalloc_reserve.constprop.0+0x30/0x74 [] __alloc_skb+0xa0/0x170 [] __netdev_alloc_skb+0x50/0x180 [] __ieee80211_beacon_get+0x290/0x4d4 [mac80211] [] ieee80211_beacon_get_tim+0x54/0x18c [mac80211] [] wfx_start_ap+0xc8/0x234 [wfx] [] ieee80211_start_ap+0x404/0x6b4 [mac80211] [] nl80211_start_ap+0x76c/0x9e0 [cfg80211] [] genl_rcv_msg+0x198/0x378 [] netlink_rcv_skb+0xd0/0x130 [] genl_rcv+0x34/0x44 [] netlink_unicast+0x1b4/0x258 [] netlink_sendmsg+0x1e8/0x428 [] ____sys_sendmsg+0x1e0/0x274 [] ___sys_sendmsg+0x80/0xb4 However, since the kernel is build optimized, it seems the stack is not accurate. It appears the issue is related to wfx_set_mfp_ap(). The issue is obvious in this function: memory allocated by ieee8021

Affected

19 ranges
VendorProductVersion rangeFixed in
debianlinux< linux 6.1.85-1 (bookworm)linux 6.1.85-1 (bookworm)
linuxlinux
linuxlinux>= 268bceec1684932e194ae87877dcc73f534d921c < a1f57a0127b89a6b6620514564aa7eaec16d9af3a1f57a0127b89a6b6620514564aa7eaec16d9af3
linuxlinux>= 268bceec1684932e194ae87877dcc73f534d921c < 3a71ec74e5e3478d202a1874f085ca3ef40be49b3a71ec74e5e3478d202a1874f085ca3ef40be49b
linuxlinux>= 268bceec1684932e194ae87877dcc73f534d921c < 12f00a367b2b62756e0396f14b54c2c15524e1c312f00a367b2b62756e0396f14b54c2c15524e1c3
linuxlinux>= 268bceec1684932e194ae87877dcc73f534d921c < dadbb5d29d6c5f571a50272fce8c1505a9559487dadbb5d29d6c5f571a50272fce8c1505a9559487
linuxlinux>= 268bceec1684932e194ae87877dcc73f534d921c < b8cfb7c819dd39965136a66fe3a7fde688d976fcb8cfb7c819dd39965136a66fe3a7fde688d976fc
linuxlinux_kernel>= 0 < 6.1.85-16.1.85-1
linuxlinux_kernel>= 0 < 6.7.12-16.7.12-1
linuxlinux_kernel>= 0 < 6.7.12-16.7.12-1
linuxlinux_kernel>= 0 < 5.15.0-160.1705.15.0-160.170
linuxlinux_kernel>= 0 < 6.8.0-35.356.8.0-35.35
linuxlinux_kernel>= 5.10 < 6.1.836.1.83
linuxlinux_kernel>= 6.2 < 6.6.236.6.23
linuxlinux_kernel>= 6.7 < 6.7.116.7.11
linuxlinux_kernel>= 6.8 < 6.8.26.8.2
msrccbl2_kernel_5.15.186.1-1_on_cbl_mariner_2.0
msrccbl2_kernel_5.15.200.1-1_on_cbl_mariner_2.0
msrccbl2_kernel_5.15.202.1-1_on_cbl_mariner_2.0

CVSS provenance

nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_ubuntu6.3MEDIUM
vendor_debian5.5MEDIUM
vendor_msrc5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.