CVE-2024-49939
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2024-49939
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-49939.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2024-49939
- Downstream
- Related
- Published
- 2024-10-21T18:01:59Z
- Modified
- 2025-10-15T01:37:22.393790Z
- Summary
- wifi: rtw89: avoid to add interface to list twice when SER
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
wifi: rtw89: avoid to add interface to list twice when SER
If SER L2 occurs during the WoWLAN resume flow, the add interface flow is triggered by ieee80211reconfig(). However, due to rtw89wow_resume() return failure, it will cause the add interface flow to be executed again, resulting in a double add list and causing a kernel panic. Therefore, we have added a check to prevent double adding of the list.
listadd double add: new=ffff99d6992e2010, prev=ffff99d6992e2010, next=ffff99d695302628. ------------[ cut here ]------------ kernel BUG at lib/listdebug.c:37! invalid opcode: 0000 [#1] PREEMPT SMP NOPTI CPU: 0 PID: 9 Comm: kworker/0:1 Tainted: G W O 6.6.30-02659-gc18865c4dfbd #1 770df2933251a0e3c888ba69d1053a817a6376a7 Hardware name: HP Grunt/Grunt, BIOS GoogleGrunt.11031.169.0 06/24/2021 Workqueue: eventsfreezable ieee80211restartwork [mac80211] RIP: 0010:_listaddvalidorreport+0x5e/0xb0 Code: c7 74 18 48 39 ce 74 13 b0 01 59 5a 5e 5f 41 58 41 59 41 5a 5d e9 e2 d6 03 00 cc 48 c7 c7 8d 4f 17 83 48 89 c2 e8 02 c0 00 00 <0f> 0b 48 c7 c7 aa 8c 1c 83 e8 f4 bf 00 00 0f 0b 48 c7 c7 c8 bc 12 RSP: 0018:ffffa91b8007bc50 EFLAGS: 00010246 RAX: 0000000000000058 RBX: ffff99d6992e0900 RCX: a014d76c70ef3900 RDX: ffffa91b8007bae8 RSI: 00000000ffffdfff RDI: 0000000000000001 RBP: ffffa91b8007bc88 R08: 0000000000000000 R09: ffffa91b8007bae0 R10: 00000000ffffdfff R11: ffffffff83a79800 R12: ffff99d695302060 R13: ffff99d695300900 R14: ffff99d6992e1be0 R15: ffff99d6992e2010 FS: 0000000000000000(0000) GS:ffff99d6aac00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000078fbdba43480 CR3: 000000010e464000 CR4: 00000000001506f0 Call Trace: <TASK> ? _diebody+0x1f/0x70 ? die+0x3d/0x60 ? dotrap+0xa4/0x110 ? _listaddvalidorreport+0x5e/0xb0 ? doerrortrap+0x6d/0x90 ? _listaddvalidorreport+0x5e/0xb0 ? handleinvalidop+0x30/0x40 ? _listaddvalidorreport+0x5e/0xb0 ? excinvalidop+0x3c/0x50 ? asmexcinvalidop+0x16/0x20 ? _listaddvalidorreport+0x5e/0xb0 rtw89opsaddinterface+0x309/0x310 [rtw89core 7c32b1ee6854761c0321027c8a58c5160e41f48f] drvaddinterface+0x5c/0x130 [mac80211 83e989e6e616bd5b4b8a2b0a9f9352a2c385a3bc] ieee80211reconfig+0x241/0x13d0 [mac80211 83e989e6e616bd5b4b8a2b0a9f9352a2c385a3bc] ? finishwait+0x3e/0x90 ? synchronizercuexpedited+0x174/0x260 ? syncrcuexpdoneunlocked+0x50/0x50 ? wakebitfunction+0x40/0x40 ieee80211restartwork+0xf0/0x140 [mac80211 83e989e6e616bd5b4b8a2b0a9f9352a2c385a3bc] processscheduledworks+0x1e5/0x480 workerthread+0xea/0x1e0 kthread+0xdb/0x110 ? movelinkedworks+0x90/0x90 ? kthreadassociateblkcg+0xa0/0xa0 retfromfork+0x3b/0x50 ? kthreadassociateblkcg+0xa0/0xa0 retfromforkasm+0x11/0x20 </TASK> Modules linked in: dmintegrity asyncxor xor asynctx lz4 lz4compress zstd zstdcompress zram zsmalloc rfcomm cmac uinput algifhash algifskcipher afalg btusb btrtl iiotrighrtimer industrialioswtrigger btmtk industrialioconfigfs btbcm btintel uvcvideo videobuf2vmalloc iiotrigsysfs videobuf2memops videobuf2v4l2 videobuf2common uvc sndhdacodechdmi veth sndhdaintel sndinteldspcfg acpials sndhdacodec industrialiotriggeredbuffer kfifobuf sndhwdep industrialio i2cpiix4 sndhdacore designwarei2s ip6tablenat sndsocmax98357a xtMASQUERADE xtcgroup sndsocacprt5682mach fuse rtw898922ae(O) rtw898922a(O) rtw89pci(O) rtw89core(O) 8021q mac80211(O) bluetooth ecdhgeneric ecc cfg80211 r8152 mii joydev gsmi: Log Shutdown Reason 0x03 ---[ end trace 0000000000000000 ]---
- References
-
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- https://git.kernel.org/stable/c/37c319503023de49a4c87301c8998c8d928112cb
- https://git.kernel.org/stable/c/490eddc836b2a6ec286e5df14bed4c7cf5e1f475
- https://git.kernel.org/stable/c/7dd5d2514a8ea58f12096e888b0bd050d7eae20a
- https://git.kernel.org/stable/c/b04650b5a9990cf5c0de480e62c68199f1396a04
- https://git.kernel.org/stable/c/fdc73f2cfbe897f4733156df211d79ced649b23c
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducede3ec7017f6a20d12ddd9fe23d345ebb7b8c104ddFixedb04650b5a9990cf5c0de480e62c68199f1396a04
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducede3ec7017f6a20d12ddd9fe23d345ebb7b8c104ddFixedfdc73f2cfbe897f4733156df211d79ced649b23c
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducede3ec7017f6a20d12ddd9fe23d345ebb7b8c104ddFixed37c319503023de49a4c87301c8998c8d928112cb
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducede3ec7017f6a20d12ddd9fe23d345ebb7b8c104ddFixed490eddc836b2a6ec286e5df14bed4c7cf5e1f475
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducede3ec7017f6a20d12ddd9fe23d345ebb7b8c104ddFixed7dd5d2514a8ea58f12096e888b0bd050d7eae20a
Affected versions
v5.*
v6.*
Database specific
{
"vanir_signatures": [
{
"id": "CVE-2024-49939-1d16557c",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b04650b5a9990cf5c0de480e62c68199f1396a04",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 1069.0,
"function_hash": "182163604839368087751533835573975068611"
},
"target": {
"file": "drivers/net/wireless/realtek/rtw89/mac80211.c",
"function": "rtw89_ops_add_interface"
}
},
{
"id": "CVE-2024-49939-34be8958",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@490eddc836b2a6ec286e5df14bed4c7cf5e1f475",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"169743756249163815277276796588847610880",
"282582404664487719061672967663790259501",
"119682273150367332533942369067951183529"
]
},
"target": {
"file": "drivers/net/wireless/realtek/rtw89/util.h"
}
},
{
"id": "CVE-2024-49939-4bc4f3ec",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7dd5d2514a8ea58f12096e888b0bd050d7eae20a",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 1568.0,
"function_hash": "46544700948715669942186326364037451977"
},
"target": {
"file": "drivers/net/wireless/realtek/rtw89/mac80211.c",
"function": "rtw89_ops_add_interface"
}
},
{
"id": "CVE-2024-49939-6e70e9b2",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@490eddc836b2a6ec286e5df14bed4c7cf5e1f475",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 1574.0,
"function_hash": "53432606389521239113951983561809110004"
},
"target": {
"file": "drivers/net/wireless/realtek/rtw89/mac80211.c",
"function": "rtw89_ops_add_interface"
}
},
{
"id": "CVE-2024-49939-7283f2cd",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fdc73f2cfbe897f4733156df211d79ced649b23c",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"169743756249163815277276796588847610880",
"282582404664487719061672967663790259501",
"119682273150367332533942369067951183529"
]
},
"target": {
"file": "drivers/net/wireless/realtek/rtw89/util.h"
}
},
{
"id": "CVE-2024-49939-759f6d34",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7dd5d2514a8ea58f12096e888b0bd050d7eae20a",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"169743756249163815277276796588847610880",
"282582404664487719061672967663790259501",
"119682273150367332533942369067951183529"
]
},
"target": {
"file": "drivers/net/wireless/realtek/rtw89/util.h"
}
},
{
"id": "CVE-2024-49939-794886e7",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b04650b5a9990cf5c0de480e62c68199f1396a04",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"169743756249163815277276796588847610880",
"282582404664487719061672967663790259501",
"119682273150367332533942369067951183529"
]
},
"target": {
"file": "drivers/net/wireless/realtek/rtw89/util.h"
}
},
{
"id": "CVE-2024-49939-af7ba8ed",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@37c319503023de49a4c87301c8998c8d928112cb",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"35136478285929340286691292915562690234",
"260357142621497454128790975523740481767",
"81987804361840225492519612276465678711",
"47599825103009977559059348944278699268"
]
},
"target": {
"file": "drivers/net/wireless/realtek/rtw89/mac80211.c"
}
},
{
"id": "CVE-2024-49939-b361529f",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7dd5d2514a8ea58f12096e888b0bd050d7eae20a",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"35136478285929340286691292915562690234",
"260357142621497454128790975523740481767",
"81987804361840225492519612276465678711",
"47599825103009977559059348944278699268"
]
},
"target": {
"file": "drivers/net/wireless/realtek/rtw89/mac80211.c"
}
},
{
"id": "CVE-2024-49939-bd602ab7",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@37c319503023de49a4c87301c8998c8d928112cb",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"169743756249163815277276796588847610880",
"282582404664487719061672967663790259501",
"119682273150367332533942369067951183529"
]
},
"target": {
"file": "drivers/net/wireless/realtek/rtw89/util.h"
}
},
{
"id": "CVE-2024-49939-d933d863",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@37c319503023de49a4c87301c8998c8d928112cb",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 1574.0,
"function_hash": "53432606389521239113951983561809110004"
},
"target": {
"file": "drivers/net/wireless/realtek/rtw89/mac80211.c",
"function": "rtw89_ops_add_interface"
}
},
{
"id": "CVE-2024-49939-ebbeba44",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b04650b5a9990cf5c0de480e62c68199f1396a04",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"43591192101396818286035947580898639199",
"211949777311891449646223464962707338317",
"250047816078134916394951553964202575350",
"64892599622877909094450964555979694396"
]
},
"target": {
"file": "drivers/net/wireless/realtek/rtw89/mac80211.c"
}
},
{
"id": "CVE-2024-49939-eedc3998",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fdc73f2cfbe897f4733156df211d79ced649b23c",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 1540.0,
"function_hash": "295196436512247648860522736632299613724"
},
"target": {
"file": "drivers/net/wireless/realtek/rtw89/mac80211.c",
"function": "rtw89_ops_add_interface"
}
},
{
"id": "CVE-2024-49939-f383e6a6",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@490eddc836b2a6ec286e5df14bed4c7cf5e1f475",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"35136478285929340286691292915562690234",
"260357142621497454128790975523740481767",
"81987804361840225492519612276465678711",
"47599825103009977559059348944278699268"
]
},
"target": {
"file": "drivers/net/wireless/realtek/rtw89/mac80211.c"
}
},
{
"id": "CVE-2024-49939-fec50819",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fdc73f2cfbe897f4733156df211d79ced649b23c",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"35136478285929340286691292915562690234",
"260357142621497454128790975523740481767",
"81987804361840225492519612276465678711",
"47599825103009977559059348944278699268"
]
},
"target": {
"file": "drivers/net/wireless/realtek/rtw89/mac80211.c"
}
}
]
}