cbcvebase.
CVE-2024-58072
published 2025-03-06

CVE-2024-58072: In the Linux kernel, the following vulnerability has been resolved: wifi: rtlwifi: remove unused check_buddy_priv Commit 2461c7d60f9f ("rtlwifi: Update header…

PriorityP339high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.19%
8.7th percentile
In the Linux kernel, the following vulnerability has been resolved: wifi: rtlwifi: remove unused check_buddy_priv Commit 2461c7d60f9f ("rtlwifi: Update header file") introduced a global list of private data structures. Later on, commit 26634c4b1868 ("rtlwifi Modify existing bits to match vendor version 2013.02.07") started adding the private data to that list at probe time and added a hook, check_buddy_priv to find the private data from a similar device. However, that function was never used. Besides, though there is a lock for that list, it is never used. And when the probe fails, the private data is never removed from the list. This would cause a second probe to access freed memory. Remove the unused hook, structures and members, which will prevent the potential race condition on the list and its corruption during a second probe when probe fails.

Affected

25 ranges
VendorProductVersion rangeFixed in
debianlinux< linux 6.1.129-1 (bookworm)linux 6.1.129-1 (bookworm)
debianlinux-6.1< linux 6.1.129-1 (bookworm)linux 6.1.129-1 (bookworm)
linuxlinux
linuxlinux>= 26634c4b1868323f49f8cd24c3493b57819867fd < f801e754efa21bd61b3cc15ec7565696165b272ff801e754efa21bd61b3cc15ec7565696165b272f
linuxlinux>= 26634c4b1868323f49f8cd24c3493b57819867fd < 1b9cbd8a9ae68b32099fbb03b2d5ffa0c5e0dcc91b9cbd8a9ae68b32099fbb03b2d5ffa0c5e0dcc9
linuxlinux>= 26634c4b1868323f49f8cd24c3493b57819867fd < 8e2fcc68fbaab3ad9f5671fee2be0956134b740a8e2fcc68fbaab3ad9f5671fee2be0956134b740a
linuxlinux>= 26634c4b1868323f49f8cd24c3493b57819867fd < 1e39b0486cdb496cdfba3bc89886150e46acf6f41e39b0486cdb496cdfba3bc89886150e46acf6f4
linuxlinux>= 26634c4b1868323f49f8cd24c3493b57819867fd < 465d01ef6962b82b1f0ad1f3e58b398dbd35c1c1465d01ef6962b82b1f0ad1f3e58b398dbd35c1c1
linuxlinux>= 26634c4b1868323f49f8cd24c3493b57819867fd < 543e3e9f2e9e47ded774c74e680f28a0ca362aee543e3e9f2e9e47ded774c74e680f28a0ca362aee
linuxlinux>= 26634c4b1868323f49f8cd24c3493b57819867fd < 006e803af7408c3fc815b0654fc5ab43d34f0154006e803af7408c3fc815b0654fc5ab43d34f0154
linuxlinux>= 26634c4b1868323f49f8cd24c3493b57819867fd < 2fdac64c3c35858aa8ac5caa70b232e03456e1202fdac64c3c35858aa8ac5caa70b232e03456e120
linuxlinux_kernel>= 0 < 5.10.237-15.10.237-1
linuxlinux_kernel>= 0 < 6.1.129-16.1.129-1
linuxlinux_kernel>= 0 < 6.12.13-16.12.13-1
linuxlinux_kernel>= 0 < 6.12.13-16.12.13-1
linuxlinux_kernel>= 0 < 5.4.0-216.2365.4.0-216.236
linuxlinux_kernel>= 0 < 5.15.0-140.1505.15.0-140.150
linuxlinux_kernel>= 0 < 6.8.0-64.676.8.0-64.67
linuxlinux_kernel>= 3.10 < 5.4.2915.4.291
linuxlinux_kernel>= 5.11 < 5.15.1795.15.179
linuxlinux_kernel>= 5.16 < 6.1.1296.1.129
linuxlinux_kernel>= 5.5 < 5.10.2355.10.235
linuxlinux_kernel>= 6.13 < 6.13.26.13.2
linuxlinux_kernel>= 6.2 < 6.6.766.6.76
linuxlinux_kernel>= 6.7 < 6.12.136.12.13

CVSS provenance

nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv8.8HIGH
vendor_ubuntu8.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.