CVE-2024-26897

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-26897
In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: delay all of ath9k_wmi_event_tasklet() until init is complete The ath9k_wmi_event_tasklet() used in ath9k_htc assumes that all the data structures have been fully initialised by the time it runs. However, because of the order in which things are initialised, this is not guaranteed to be the case, because the device is exposed to the USB subsystem before the ath9k driver initialisation is completed. We already committed a partial fix for this in commit: 8b3046abc99e ("ath9k_htc: fix NULL pointer dereference at ath9k_htc_tx_get_packet()") However, that commit only aborted the WMI_TXSTATUS_EVENTID command in the event tasklet, pairing it with an "initialisation complete" bit in the TX struct. It seems syzbot managed to trigger the race for one of the other commands as well, so let's just move the existing synchronisation bit to cover the whole tasklet (setting it at the end of ath9k_htc_probe_device() instead of inside ath9k_tx_init()).

4.7 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.0 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/1bc5461a21c56a36e2a7d81e152b90ce019a3905 Patch
https://git.kernel.org/stable/c/24355fcb0d4cbcb6ddda262596558e8cfba70f11 Patch
https://git.kernel.org/stable/c/4afa0246656d5680c8a4c3fb37ba6570c4ab819b Patch
https://git.kernel.org/stable/c/74d0639261dd795dce958d1b14815bdcbb48a715 Patch
https://git.kernel.org/stable/c/a015fbf698c8957aa5fbeefc5c59dd2cf3107298 Patch
https://git.kernel.org/stable/c/ac90e22e735bac44f74b5161fb096fbeb0ff8bc2 Patch
https://git.kernel.org/stable/c/f8ff4b4df71e87f609be0cc37d92e918107f9b90 Patch
https://git.kernel.org/stable/c/1bc5461a21c56a36e2a7d81e152b90ce019a3905 Patch
https://git.kernel.org/stable/c/24355fcb0d4cbcb6ddda262596558e8cfba70f11 Patch
https://git.kernel.org/stable/c/4afa0246656d5680c8a4c3fb37ba6570c4ab819b Patch
https://git.kernel.org/stable/c/74d0639261dd795dce958d1b14815bdcbb48a715 Patch
https://git.kernel.org/stable/c/a015fbf698c8957aa5fbeefc5c59dd2cf3107298 Patch
https://git.kernel.org/stable/c/ac90e22e735bac44f74b5161fb096fbeb0ff8bc2 Patch
https://git.kernel.org/stable/c/f8ff4b4df71e87f609be0cc37d92e918107f9b90 Patch
https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
History

23 Dec 2025, 19:08

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 4.7
CPE cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
CWE CWE-362
References () https://git.kernel.org/stable/c/1bc5461a21c56a36e2a7d81e152b90ce019a3905 - () https://git.kernel.org/stable/c/1bc5461a21c56a36e2a7d81e152b90ce019a3905 - Patch
References () https://git.kernel.org/stable/c/24355fcb0d4cbcb6ddda262596558e8cfba70f11 - () https://git.kernel.org/stable/c/24355fcb0d4cbcb6ddda262596558e8cfba70f11 - Patch
References () https://git.kernel.org/stable/c/4afa0246656d5680c8a4c3fb37ba6570c4ab819b - () https://git.kernel.org/stable/c/4afa0246656d5680c8a4c3fb37ba6570c4ab819b - Patch
References () https://git.kernel.org/stable/c/74d0639261dd795dce958d1b14815bdcbb48a715 - () https://git.kernel.org/stable/c/74d0639261dd795dce958d1b14815bdcbb48a715 - Patch
References () https://git.kernel.org/stable/c/a015fbf698c8957aa5fbeefc5c59dd2cf3107298 - () https://git.kernel.org/stable/c/a015fbf698c8957aa5fbeefc5c59dd2cf3107298 - Patch
References () https://git.kernel.org/stable/c/ac90e22e735bac44f74b5161fb096fbeb0ff8bc2 - () https://git.kernel.org/stable/c/ac90e22e735bac44f74b5161fb096fbeb0ff8bc2 - Patch
References () https://git.kernel.org/stable/c/f8ff4b4df71e87f609be0cc37d92e918107f9b90 - () https://git.kernel.org/stable/c/f8ff4b4df71e87f609be0cc37d92e918107f9b90 - Patch
References () https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html - () https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html - Third Party Advisory
First Time Linux
Debian
Debian debian Linux
Linux linux Kernel

21 Nov 2024, 09:03

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html -
References () https://git.kernel.org/stable/c/1bc5461a21c56a36e2a7d81e152b90ce019a3905 - () https://git.kernel.org/stable/c/1bc5461a21c56a36e2a7d81e152b90ce019a3905 -
References () https://git.kernel.org/stable/c/24355fcb0d4cbcb6ddda262596558e8cfba70f11 - () https://git.kernel.org/stable/c/24355fcb0d4cbcb6ddda262596558e8cfba70f11 -
References () https://git.kernel.org/stable/c/4afa0246656d5680c8a4c3fb37ba6570c4ab819b - () https://git.kernel.org/stable/c/4afa0246656d5680c8a4c3fb37ba6570c4ab819b -
References () https://git.kernel.org/stable/c/74d0639261dd795dce958d1b14815bdcbb48a715 - () https://git.kernel.org/stable/c/74d0639261dd795dce958d1b14815bdcbb48a715 -
References () https://git.kernel.org/stable/c/a015fbf698c8957aa5fbeefc5c59dd2cf3107298 - () https://git.kernel.org/stable/c/a015fbf698c8957aa5fbeefc5c59dd2cf3107298 -
References () https://git.kernel.org/stable/c/ac90e22e735bac44f74b5161fb096fbeb0ff8bc2 - () https://git.kernel.org/stable/c/ac90e22e735bac44f74b5161fb096fbeb0ff8bc2 -
References () https://git.kernel.org/stable/c/f8ff4b4df71e87f609be0cc37d92e918107f9b90 - () https://git.kernel.org/stable/c/f8ff4b4df71e87f609be0cc37d92e918107f9b90 -

05 Nov 2024, 10:16

Type Values Removed Values Added
References
  • {'url': 'https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html', 'source': '416baaa9-dc9f-4396-8d5f-8c081fb06d67'}

25 Jun 2024, 23:15

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html -
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: wifi: ath9k: retrasa todo ath9k_wmi_event_tasklet() hasta que se complete el inicio. El ath9k_wmi_event_tasklet() usado en ath9k_htc supone que todas las estructuras de datos se han inicializado por completo en el momento de su ejecución. Sin embargo, debido al orden en que se inicializan las cosas, no se garantiza que este sea el caso, porque el dispositivo queda expuesto al subsistema USB antes de que se complete la inicialización del controlador ath9k. Ya cometimos una solución parcial para esto en la confirmación: 8b3046abc99e ("ath9k_htc: corrige la desreferencia del puntero NULL en ath9k_htc_tx_get_packet()") Sin embargo, esa confirmación solo abortó el comando WMI_TXSTATUS_EVENTID en el tasklet de eventos, emparejándolo con un bit de "inicialización completa" en la estructura TX. Parece que syzbot también logró activar la carrera para uno de los otros comandos, así que simplemente movamos el bit de sincronización existente para cubrir todo el tasklet (configurándolo al final de ath9k_htc_probe_device() en lugar de dentro de ath9k_tx_init()).

17 Apr 2024, 11:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-04-17 11:15

Updated : 2025-12-23 19:08

NVD link : CVE-2024-26897

Mitre link : CVE-2024-26897

CVE.ORG link : CVE-2024-26897

JSON object : View

Products Affected

debian

  • debian_linux

linux

  • linux_kernel
CWE
CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')