CVE-2024-26693

Source
https://nvd.nist.gov/vuln/detail/CVE-2024-26693
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-26693.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-26693
Downstream
Related
Published
2024-04-03T14:54:54Z
Modified
2025-10-09T02:51:55.322401Z
Summary
wifi: iwlwifi: mvm: fix a crash when we run out of stations
Details

In the Linux kernel, the following vulnerability has been resolved:

wifi: iwlwifi: mvm: fix a crash when we run out of stations

A DoS tool that injects loads of authentication frames made our AP crash. The iwlmvmisdup() function couldn't find the per-queue dupdata which was not allocated.

The root cause for that is that we ran out of stations in the firmware and we didn't really add the station to the firmware, yet we didn't return an error to mac80211. Mac80211 was thinking that we have the station and because of that, stainfo::uploaded was set to 1. This allowed ieee80211findstabyifaddr() to return a valid station object, but that ieee80211sta didn't have any iwlmvmsta object initialized and that caused the crash mentioned earlier when we got Rx on that station.

References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
57974a55d995468a9a476e24693eb741c649b25f
Fixed
00f4eb31b8193f6070ce24df636883f9c104ca95
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
57974a55d995468a9a476e24693eb741c649b25f
Fixed
c12f0f4d4caf23b1bfdc2602b6b70d56bdcd6aa7
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
57974a55d995468a9a476e24693eb741c649b25f
Fixed
b7198383ef2debe748118996f627452281cf27d7

Affected versions

v6.*

v6.3
v6.3-rc2
v6.3-rc3
v6.3-rc4
v6.3-rc5
v6.3-rc6
v6.3-rc7
v6.4
v6.4-rc1
v6.4-rc2
v6.4-rc3
v6.4-rc4
v6.4-rc5
v6.4-rc6
v6.4-rc7
v6.5
v6.5-rc1
v6.5-rc2
v6.5-rc3
v6.5-rc4
v6.5-rc5
v6.5-rc6
v6.5-rc7
v6.6
v6.6-rc1
v6.6-rc2
v6.6-rc3
v6.6-rc4
v6.6-rc5
v6.6-rc6
v6.6-rc7
v6.6.1
v6.6.10
v6.6.11
v6.6.12
v6.6.13
v6.6.14
v6.6.15
v6.6.16
v6.6.17
v6.6.2
v6.6.3
v6.6.4
v6.6.5
v6.6.6
v6.6.7
v6.6.8
v6.6.9
v6.7
v6.7-rc1
v6.7-rc2
v6.7-rc3
v6.7-rc4
v6.7-rc5
v6.7-rc6
v6.7-rc7
v6.7-rc8
v6.7.1
v6.7.2
v6.7.3
v6.7.4
v6.7.5
v6.8-rc1

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.4.0
Fixed
6.6.18
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.7.6