CVE-2024-44997
published 2024-09-04CVE-2024-44997: In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_wed: fix use-after-free panic in mtk_wed_setup_tc_block_cb() When there…
PriorityP339high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.21%
11.8th percentile
In the Linux kernel, the following vulnerability has been resolved:
net: ethernet: mtk_wed: fix use-after-free panic in mtk_wed_setup_tc_block_cb()
When there are multiple ap interfaces on one band and with WED on,
turning the interface down will cause a kernel panic on MT798X.
Previously, cb_priv was freed in mtk_wed_setup_tc_block() without
marking NULL,and mtk_wed_setup_tc_block_cb() didn't check the value, too.
Assign NULL after free cb_priv in mtk_wed_setup_tc_block() and check NULL
in mtk_wed_setup_tc_block_cb().
Unable to handle kernel paging request at virtual address 0072460bca32b4f5
Call trace:
mtk_wed_setup_tc_block_cb+0x4/0x38
0xffffffc0794084bc
tcf_block_playback_offloads+0x70/0x1e8
tcf_block_unbind+0x6c/0xc8
...
Affected
14 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.10.7-1 (forky) | linux 6.10.7-1 (forky) |
| linux | linux | — | — |
| linux | linux | >= 799684448e3e1f57257a6155541e53510488f67b < 326a89321f9d5fe399fe6f9ff7c0fc766582a6a0 | 326a89321f9d5fe399fe6f9ff7c0fc766582a6a0 |
| linux | linux | >= 799684448e3e1f57257a6155541e53510488f67b < b453a4bbda03aa8741279c360ac82d1c3ac33548 | b453a4bbda03aa8741279c360ac82d1c3ac33548 |
| linux | linux | >= 799684448e3e1f57257a6155541e53510488f67b < db1b4bedb9b97c6d34b03d03815147c04fffe8b4 | db1b4bedb9b97c6d34b03d03815147c04fffe8b4 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 6.10.7-1 | 6.10.7-1 |
| linux | linux_kernel | >= 0 < 6.10.7-1 | 6.10.7-1 |
| linux | linux_kernel | >= 6.2 < 6.6.48 | 6.6.48 |
| linux | linux_kernel | >= 6.7 < 6.10.7 | 6.10.7 |
| msrc | azl3_kernel_6.6.47.1-1_on_azure_linux_3.0 | — | — |
| msrc | azl3_kernel_6.6.51.1-1_on_azure_linux_3.0 | — | — |
| msrc | azure_linux_3.0_arm | — | — |
| msrc | azure_linux_3.0_x64 | — | — |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_debian7.8LOW
vendor_msrc7.8HIGH
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Microsoft
net: ethernet: mtk_wed: fix use-after-free panic in mtk_wed_setup_tc_block_cb()
vendor_msrc·2024-09-10·CVSS 7.8
CVE-2024-44997 [HIGH] CWE-416 net: ethernet: mtk_wed: fix use-after-free panic in mtk_wed_setup_tc_block_cb()
net: ethernet: mtk_wed: fix use-after-free panic in mtk_wed_setup_tc_block_cb()
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
Linux: Linux
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Red Hat
kernel: net: ethernet: mtk_wed: fix use-after-free panic in mtk_wed_setup_tc_block_cb()
vendor_redhat·2024-09-04·CVSS 7.8
CVE-2024-44997 [HIGH] CWE-416 kernel: net: ethernet: mtk_wed: fix use-after-free panic in mtk_wed_setup_tc_block_cb()
kernel: net: ethernet: mtk_wed: fix use-after-free panic in mtk_wed_setup_tc_block_cb()
In the Linux kernel, the following vulnerability has been resolved:
net: ethernet: mtk_wed: fix use-after-free panic in mtk_wed_setup_tc_block_cb()
When there are multiple ap interfaces on one band and with WED on,
turning the interface down will cause a kernel panic on MT798X.
Previously, cb_priv was freed in mtk_wed_setup_tc_block() without
marking NULL,and mtk_wed_setup_tc_block_cb() didn't check the value, too.
Assign NULL after free cb_priv in mtk_wed_setup_tc_block() and check NULL
in mtk_wed_setup_tc_block_cb().
Unable to handle kernel paging request at virtual address 0072460bca32b4f5
Call trace:
mtk_wed_setup_tc_block_cb+0x4/0x38
0xffffffc0794084bc
tcf_block_playback_offloads+0x70/0x1e8
tcf_bl
Debian
CVE-2024-44997: linux - In the Linux kernel, the following vulnerability has been resolved: net: ethern...
vendor_debian·2024·CVSS 7.8
CVE-2024-44997 [HIGH] CVE-2024-44997: linux - In the Linux kernel, the following vulnerability has been resolved: net: ethern...
In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_wed: fix use-after-free panic in mtk_wed_setup_tc_block_cb() When there are multiple ap interfaces on one band and with WED on, turning the interface down will cause a kernel panic on MT798X. Previously, cb_priv was freed in mtk_wed_setup_tc_block() without marking NULL,and mtk_wed_setup_tc_block_cb() didn't check the value, too. Assign NULL after free cb_priv in mtk_wed_setup_tc_block() and check NULL in mtk_wed_setup_tc_block_cb(). ---------- Unable to handle kernel paging request at virtual address 0072460bca32b4f5 Call trace: mtk_wed_setup_tc_block_cb+0x4/0x38 0xffffffc0794084bc tcf_block_playback_offloads+0x70/0x1e8 tcf_block_unbind+0x6c/0xc8 ... ---------
Scope: local
bookworm: resolved
bullseye: r
OSV
CVE-2024-44997: In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_wed: fix use-after-free panic in mtk_wed_setup_tc_block_cb() Wh
osv·2024-09-04·CVSS 7.8
CVE-2024-44997 [HIGH] CVE-2024-44997: In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_wed: fix use-after-free panic in mtk_wed_setup_tc_block_cb() Wh
In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_wed: fix use-after-free panic in mtk_wed_setup_tc_block_cb() When there are multiple ap interfaces on one band and with WED on, turning the interface down will cause a kernel panic on MT798X. Previously, cb_priv was freed in mtk_wed_setup_tc_block() without marking NULL,and mtk_wed_setup_tc_block_cb() didn't check the value, too. Assign NULL after free cb_priv in mtk_wed_setup_tc_block() and check NULL in mtk_wed_setup_tc_block_cb(). ---------- Unable to handle kernel paging request at virtual address 0072460bca32b4f5 Call trace: mtk_wed_setup_tc_block_cb+0x4/0x38 0xffffffc0794084bc tcf_block_playback_offloads+0x70/0x1e8 tcf_block_unbind+0x6c/0xc8 ... ---------
GHSA
GHSA-2jrr-ff5x-5jqg: In the Linux kernel, the following vulnerability has been resolved:
net: ethernet: mtk_wed: fix use-after-free panic in mtk_wed_setup_tc_block_cb()
ghsa_unreviewed·2024-09-04
CVE-2024-44997 [HIGH] CWE-416 GHSA-2jrr-ff5x-5jqg: In the Linux kernel, the following vulnerability has been resolved:
net: ethernet: mtk_wed: fix use-after-free panic in mtk_wed_setup_tc_block_cb()
In the Linux kernel, the following vulnerability has been resolved:
net: ethernet: mtk_wed: fix use-after-free panic in mtk_wed_setup_tc_block_cb()
When there are multiple ap interfaces on one band and with WED on,
turning the interface down will cause a kernel panic on MT798X.
Previously, cb_priv was freed in mtk_wed_setup_tc_block() without
marking NULL,and mtk_wed_setup_tc_block_cb() didn't check the value, too.
Assign NULL after free cb_priv in mtk_wed_setup_tc_block() and check NULL
in mtk_wed_setup_tc_block_cb().
Unable to handle kernel paging request at virtual address 0072460bca32b4f5
Call trace:
mtk_wed_setup_tc_block_cb+0x4/0x38
0xffffffc0794084bc
tcf_block_playback_offloads+0x70/0x1e8
tcf_block_unbind+0x6c/0xc8
...
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-09-04
Published