CVE-2024-47718

HighCVSS 7.8/10Last modified Oct 15, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: rtw88: always wait for both firmware loading attempts

In 'rtw_wait_firmware_completion()', always wait for both (regular and wowlan) firmware loading attempts. Otherwise if 'rtw_usb_intf_init()' has failed in 'rtw_usb_probe()', 'rtw_usb_disconnect()' may issue 'ieee80211_free_hw()' when one of 'rtw_load_firmware_cb()' (usually the wowlan one) is still in progress, causing UAF detected by KASAN.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

VendorProductVersions
LinuxLinux>= c8e5695eae9959fc5774c0f490f2450be8bad3de, < a0c1e2da652cf70825739bc12d49ea15805690bf; >= c8e5695eae9959fc5774c0f490f2450be8bad3de, < ceaab3fb64d6a5426a3db8f87f3e5757964f2532; >= c8e5695eae9959fc5774c0f490f2450be8bad3de, < 7887ad11995a4142671cc49146db536f923c8568; >= c8e5695eae9959fc5774c0f490f2450be8bad3de, < 1b8178a2ae272256ea0dc4f940320a81003535e2; >= c8e5695eae9959fc5774c0f490f2450be8bad3de, < 9432185540bafd42b7bfac6e6ef2f0a0fb4be447; >= c8e5695eae9959fc5774c0f490f2450be8bad3de, < e9a78d9417e167410d6fb83c4e908b077ad8ba6d; >= c8e5695eae9959fc5774c0f490f2450be8bad3de, < 0e735a4c6137262bcefe45bb52fde7b1f5fc6c4d
LinuxLinux5.6
SiemensSIMATIC S7-1500 TM MFP - GNU/Linux subsystem< V1.1.1

References

Timeline

Published
Oct 21, 2024
Last modified
Oct 15, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-477197.8In the Linux kernel, the following vulnerability has been resolved: iommufd: Protect against overflow of ALIGN() during iova allocation UsCVE-2024-47725.9An HTTP digest authentication nonce value was generated using `rand()` which could lead to predictable values. This vulnerability affects FiCVE-2024-477205.5In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Add null check for set_output_gamma in dcn30_set_outpuCVE-2024-477217.1In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: remove unused C2H event ID RTW89_MAC_C2H_FUNC_READ_WOW_CAMCVE-2024-477237.1In the Linux kernel, the following vulnerability has been resolved: jfs: fix out-of-bounds in dbNextAG() and diAlloc() In dbNextAG() , theCVE-2024-477245.5In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: use work queue to process beacon tx event Commit 3a415daCVE-2024-477266.5In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to wait dio completion It should wait all existing dio writeCVE-2024-477277.8In the Linux kernel, the following vulnerability has been resolved: x86/tdx: Fix "in-kernel MMIO" check TDX only supports kernel-initiatedCVE-2024-477285.5In the Linux kernel, the following vulnerability has been resolved: bpf: Zero former ARG_PTR_TO_{LONG,INT} args in case of error For all nCVE-2024-477295.5In the Linux kernel, the following vulnerability has been resolved: drm/xe: Use reserved copy engine for user binds on faulting devices UsCVE-2024-47737.5When a network error occurred during page load, the prior content could have remained in view with a blank URL bar. This could have been useCVE-2024-477307.8In the Linux kernel, the following vulnerability has been resolved: crypto: hisilicon/qm - inject error before stopping queue The master o