{"id":"CVE-2024-35789","state":"PUBLISHED","title":"wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes\n\nWhen moving a station out of a VLAN and deleting the VLAN afterwards, the\nfast_rx entry still holds a pointer to the VLAN's netdev, which can cause\nuse-after-free bugs. Fix this by immediately calling ieee80211_check_fast_rx\nafter the VLAN change.","publishedAt":"2024-05-17T12:24:42.323Z","updatedAt":"2026-10-15T00:40:48.629Z","severity":{"score":8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"a7f1721684628b8ae6015bca9a176046ee6f30cc","status":"affected","lessThan":"ea9a0cfc07a7d3601cc680718d9cff0d6927a921","versionType":"git"},{"version":"bd7e90c82850f49c23004d54de14e46d373748a6","status":"affected","lessThan":"be1dd9254fc115321d6fbee042026d42afc8d931","versionType":"git"},{"version":"cc413b375c6d95e68a4629cb1ba9d099de78ebb9","status":"affected","lessThan":"e8b067c4058c0121ac8ca71559df8e2e08ff1a7e","versionType":"git"},{"version":"dd0b45538146cb6a54d6da7663b8c3afd16ebcfd","status":"affected","lessThan":"c8bddbd91bc8e42c961a5e2cec20ab879f21100f","versionType":"git"},{"version":"dd0b45538146cb6a54d6da7663b8c3afd16ebcfd","status":"affected","lessThan":"7eeabcea79b67cc29563e6a9a5c81f9e2c664d5b","versionType":"git"},{"version":"dd0b45538146cb6a54d6da7663b8c3afd16ebcfd","status":"affected","lessThan":"6b948b54c8bd620725e0c906e44b10c0b13087a7","versionType":"git"},{"version":"dd0b45538146cb6a54d6da7663b8c3afd16ebcfd","status":"affected","lessThan":"2884a50f52313a7a911de3afcad065ddbb3d78fc","versionType":"git"},{"version":"dd0b45538146cb6a54d6da7663b8c3afd16ebcfd","status":"affected","lessThan":"e8678551c0243f799b4859448781cbec1bd6f1cb","versionType":"git"},{"version":"dd0b45538146cb6a54d6da7663b8c3afd16ebcfd","status":"affected","lessThan":"4f2bdb3c5e3189297e156b3ff84b140423d64685","versionType":"git"},{"version":"22bc2a4814440c4a8979a381f46fec5d224f5c11","status":"affected","versionType":"git"},{"version":"7cfe824f681e1aaac34ea64bb4def8a77801b672","status":"affected","versionType":"git"},{"version":"4.19.189","status":"affected","lessThan":"4.19.312","versionType":"semver"},{"version":"5.4.114","status":"affected","lessThan":"5.4.274","versionType":"semver"},{"version":"5.10.32","status":"affected","lessThan":"5.10.215","versionType":"semver"},{"version":"4.14.232","status":"affected","lessThan":"4.15","versionType":"semver"},{"version":"5.11.16","status":"affected","lessThan":"5.12","versionType":"semver"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/mac80211/cfg.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.12","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.12","versionType":"semver"},{"version":"4.19.312","status":"unaffected","lessThanOrEqual":"4.19.*","versionType":"semver"},{"version":"5.4.274","status":"unaffected","lessThanOrEqual":"5.4.*","versionType":"semver"},{"version":"5.10.215","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.154","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.84","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.24","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.7.12","status":"unaffected","lessThanOrEqual":"6.7.*","versionType":"semver"},{"version":"6.8.3","status":"unaffected","lessThanOrEqual":"6.8.*","versionType":"semver"},{"version":"6.9","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/mac80211/cfg.c"]}],"references":["https://git.kernel.org/stable/c/ea9a0cfc07a7d3601cc680718d9cff0d6927a921","https://git.kernel.org/stable/c/be1dd9254fc115321d6fbee042026d42afc8d931","https://git.kernel.org/stable/c/e8b067c4058c0121ac8ca71559df8e2e08ff1a7e","https://git.kernel.org/stable/c/c8bddbd91bc8e42c961a5e2cec20ab879f21100f","https://git.kernel.org/stable/c/7eeabcea79b67cc29563e6a9a5c81f9e2c664d5b","https://git.kernel.org/stable/c/6b948b54c8bd620725e0c906e44b10c0b13087a7","https://git.kernel.org/stable/c/2884a50f52313a7a911de3afcad065ddbb3d78fc","https://git.kernel.org/stable/c/e8678551c0243f799b4859448781cbec1bd6f1cb","https://git.kernel.org/stable/c/4f2bdb3c5e3189297e156b3ff84b140423d64685","https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html","https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html","https://cert-portal.siemens.com/productcert/html/ssa-265688.html"],"weaknesses":[],"ingestedAt":"2026-10-29T20:07:30.303Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/35xxx/CVE-2024-35789.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-35789","state":"PUBLISHED","datePublished":"2024-05-17T12:24:42.323Z","dateUpdated":"2026-10-15T00:40:48.629Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2024-05-17T12:19:12.338Z"},"containers":{"cna":{"title":"wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes\n\nWhen moving a station out of a VLAN and deleting the VLAN afterwards, the\nfast_rx entry still holds a pointer to the VLAN's netdev, which can cause\nuse-after-free bugs. Fix this by immediately calling ieee80211_check_fast_rx\nafter the VLAN change."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"a7f1721684628b8ae6015bca9a176046ee6f30cc","status":"affected","lessThan":"ea9a0cfc07a7d3601cc680718d9cff0d6927a921","versionType":"git"},{"version":"bd7e90c82850f49c23004d54de14e46d373748a6","status":"affected","lessThan":"be1dd9254fc115321d6fbee042026d42afc8d931","versionType":"git"},{"version":"cc413b375c6d95e68a4629cb1ba9d099de78ebb9","status":"affected","lessThan":"e8b067c4058c0121ac8ca71559df8e2e08ff1a7e","versionType":"git"},{"version":"dd0b45538146cb6a54d6da7663b8c3afd16ebcfd","status":"affected","lessThan":"c8bddbd91bc8e42c961a5e2cec20ab879f21100f","versionType":"git"},{"version":"dd0b45538146cb6a54d6da7663b8c3afd16ebcfd","status":"affected","lessThan":"7eeabcea79b67cc29563e6a9a5c81f9e2c664d5b","versionType":"git"},{"version":"dd0b45538146cb6a54d6da7663b8c3afd16ebcfd","status":"affected","lessThan":"6b948b54c8bd620725e0c906e44b10c0b13087a7","versionType":"git"},{"version":"dd0b45538146cb6a54d6da7663b8c3afd16ebcfd","status":"affected","lessThan":"2884a50f52313a7a911de3afcad065ddbb3d78fc","versionType":"git"},{"version":"dd0b45538146cb6a54d6da7663b8c3afd16ebcfd","status":"affected","lessThan":"e8678551c0243f799b4859448781cbec1bd6f1cb","versionType":"git"},{"version":"dd0b45538146cb6a54d6da7663b8c3afd16ebcfd","status":"affected","lessThan":"4f2bdb3c5e3189297e156b3ff84b140423d64685","versionType":"git"},{"version":"22bc2a4814440c4a8979a381f46fec5d224f5c11","status":"affected","versionType":"git"},{"version":"7cfe824f681e1aaac34ea64bb4def8a77801b672","status":"affected","versionType":"git"},{"version":"4.19.189","status":"affected","lessThan":"4.19.312","versionType":"semver"},{"version":"5.4.114","status":"affected","lessThan":"5.4.274","versionType":"semver"},{"version":"5.10.32","status":"affected","lessThan":"5.10.215","versionType":"semver"},{"version":"4.14.232","status":"affected","lessThan":"4.15","versionType":"semver"},{"version":"5.11.16","status":"affected","lessThan":"5.12","versionType":"semver"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/mac80211/cfg.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.12","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.12","versionType":"semver"},{"version":"4.19.312","status":"unaffected","lessThanOrEqual":"4.19.*","versionType":"semver"},{"version":"5.4.274","status":"unaffected","lessThanOrEqual":"5.4.*","versionType":"semver"},{"version":"5.10.215","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.154","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.84","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.24","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.7.12","status":"unaffected","lessThanOrEqual":"6.7.*","versionType":"semver"},{"version":"6.8.3","status":"unaffected","lessThanOrEqual":"6.8.*","versionType":"semver"},{"version":"6.9","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/mac80211/cfg.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/ea9a0cfc07a7d3601cc680718d9cff0d6927a921"},{"url":"https://git.kernel.org/stable/c/be1dd9254fc115321d6fbee042026d42afc8d931"},{"url":"https://git.kernel.org/stable/c/e8b067c4058c0121ac8ca71559df8e2e08ff1a7e"},{"url":"https://git.kernel.org/stable/c/c8bddbd91bc8e42c961a5e2cec20ab879f21100f"},{"url":"https://git.kernel.org/stable/c/7eeabcea79b67cc29563e6a9a5c81f9e2c664d5b"},{"url":"https://git.kernel.org/stable/c/6b948b54c8bd620725e0c906e44b10c0b13087a7"},{"url":"https://git.kernel.org/stable/c/2884a50f52313a7a911de3afcad065ddbb3d78fc"},{"url":"https://git.kernel.org/stable/c/e8678551c0243f799b4859448781cbec1bd6f1cb"},{"url":"https://git.kernel.org/stable/c/4f2bdb3c5e3189297e156b3ff84b140423d64685"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:A - The stale `fast_rx->dev` is dereferenced in the 802.11 receive fast path (`ieee80211_rx_8023`) when processing a data frame from the affected station, so the attacker must be an associated WiFi client within radio range of the AP. This is link-local 802.11 reachability, not routable network reach, hence Adjacent.\nAC:L - Once the station has been moved out of a VLAN that is subsequently deleted, every subsequent data frame the attacker transmits deterministically dereferences the freed netdev — there is no race to win and no memory layout the attacker cannot influence. In a hostapd dynamic-VLAN deployment the attacker induces the move itself by reauthenticating into a different RADIUS-assigned VLAN, and can repeat the sequence at will.\nPR:L - `ieee80211_check_fast_rx` only installs a `fast_rx` entry for a station with `WLAN_STA_AUTHORIZED` and a CCMP/GCMP PTK, so the attacker must be an authenticated, authorized client of the WLAN. That is an ordinary low-privileged network user, not an administrator.\nUI:N - No victim action is needed — the VLAN reassignment and teardown are performed automatically by hostapd in response to the attacker's own (re)authentication, and the attacker's own transmitted frames trigger the dereference.\nS:U - The use-after-free corrupts kernel memory and is exploited within the kernel's own security authority on the AP; there is no hypervisor, IOMMU, or sandbox boundary crossed.\nC:H - The freed `struct net_device` is read for `->tstats`, `->dev_addr` and `->nd_net`, and the skb is delivered into the stack using that stale pointer, so a groomed reclaim yields controlled kernel reads and misdirected traffic delivery; if the slot is reused by a live netdev, the station's frames leak into a different VLAN, defeating the segmentation the VLAN exists to enforce.\nI:H - `dev_sw_netstats_rx_add(fast_rx->dev, skb->len)` reads a per-CPU pointer out of the freed object and writes `rx_bytes += skb->len` (attacker-chosen length) plus `rx_packets++` through it, giving a repeatable, attacker-influenced arbitrary-increment write primitive; combined with the UAF read this is exploitable for control-flow hijacking, and the stale `dev` also permits frame injection into the wrong VLAN.\nA:H - Dereferencing a freed `net_device` from RX softirq context — including an indirect write through a dangling `->tstats` and passing the freed device to `eth_type_trans`/`netif_receive_skb` — reliably oopses or panics the access point kernel on the first frame after VLAN teardown."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T11:29:56.138Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.19.189","versionEndExcluding":"4.19.312"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.4.114","versionEndExcluding":"5.4.274"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.10.32","versionEndExcluding":"5.10.215"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.12","versionEndExcluding":"5.15.154"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.12","versionEndExcluding":"6.1.84"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.12","versionEndExcluding":"6.6.24"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.12","versionEndExcluding":"6.7.12"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.12","versionEndExcluding":"6.8.3"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.12","versionEndExcluding":"6.9"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.14.232"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.11.16"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2024-35789","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2024-05-24T14:19:23.131138Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-06-04T17:33:29.281Z"}},{"title":"CVE Program Container","references":[{"url":"https://git.kernel.org/stable/c/ea9a0cfc07a7d3601cc680718d9cff0d6927a921","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/be1dd9254fc115321d6fbee042026d42afc8d931","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/e8b067c4058c0121ac8ca71559df8e2e08ff1a7e","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/c8bddbd91bc8e42c961a5e2cec20ab879f21100f","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/7eeabcea79b67cc29563e6a9a5c81f9e2c664d5b","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/6b948b54c8bd620725e0c906e44b10c0b13087a7","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/2884a50f52313a7a911de3afcad065ddbb3d78fc","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/e8678551c0243f799b4859448781cbec1bd6f1cb","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/4f2bdb3c5e3189297e156b3ff84b140423d64685","tags":["x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html","tags":["x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T03:21:47.402Z"}},{"affected":[{"vendor":"Siemens","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"V1.1.1","versionType":"custom"}]}],"references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-265688.html"}],"providerMetadata":{"shortName":"siemens-SADP","orgId":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","dateUpdated":"2026-10-15T00:40:48.629Z"},"x_adpType":"supplier"}]}}}