CVE-2024-26779 wifi: mac80211: fix race condition on enabling fast-xmit

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix race condition on enabling fast-xmit fast-xmit must only be enabled after the sta has been uploaded to the driver, otherwise it could end up passing the not-yet-uploaded sta via drvtx calls to the driver,...

CVE-2024-26779

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix race condition on enabling fast-xmit fast-xmit must only be enabled after the sta has been uploaded to the driver, otherwise it could end up passing the not-yet-uploaded sta via drvtx calls to the driver,...

DEBIAN-CVE-2024-26694

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: fix double-free bug The storage for the TLV PC register data wasn't done like all the other storage in the drv-fw area, which is cleared at the end of deallocation. Therefore, the freeing must also be done...

CVE-2024-26693

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix a crash when we run out of stations A DoS tool that injects loads of authentication frames made our AP crash. The iwlmvmisdup function couldn't find the per-queue dupdata which was not allocated. The root...

CVE-2024-26694

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: fix double-free bug The storage for the TLV PC register data wasn't done like all the other storage in the drv-fw area, which is cleared at the end of deallocation. Therefore, the freeing must also be done...

CVE-2024-26694

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: fix double-free bug The storage for the TLV PC register data wasn't done like all the other storage in the drv-fw area, which is cleared at the end of deallocation. Therefore, the freeing must also be done...

CVE-2024-26693

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix a crash when we run out of stations A DoS tool that injects loads of authentication frames made our AP crash. The iwlmvmisdup function couldn't find the per-queue dupdata which was not allocated. The root...

CVE-2024-26694

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: fix double-free bug The storage for the TLV PC register data wasn't done like all the other storage in the drv-fw area, which is cleared at the end of deallocation. Therefore, the freeing must also be done...

CVE-2024-26693

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix a crash when we run out of stations A DoS tool that injects loads of authentication frames made our AP crash. The iwlmvmisdup function couldn't find the per-queue dupdata which was not allocated. The root...

CVE-2024-26682

A vulnerability was found in the Linux kernel, in the handling of CSA and ECSA elements during connection attempts. This issue can lead to network instability issues where certain APs are never connected to because the connection is wrongly blocked...

CVE-2024-26683

A vulnerability was found in the Linux kernel. This issue occurs when an AP continually advertises a stuck ECSA element, leading to incorrect channel switch process handling. This can lead to network connectivity issues if the AP is stuck in a state where it continuously advertises a false channe...

PT-2024-20020 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android affected versions not specified Description: The issue is related to a missing permission check in the onCreate method of WifiDialogActivity.java, which could allow bypassing the DISALLOW ADD WIFI CONFIG restriction. This could lead t...

Tenda FH1205 setSchedWifi method stack buffer overflow vulnerability

The Tenda FH1205 is a home wireless router from China's Tenda, geared toward the average home network environment, providing wireless connectivity. The Tenda FH1205 suffers from a stack buffer overflow vulnerability that stems from the schedStartTime parameter of the setSchedWifi method failing t...

CVE-2024-26666

A flaw was found in the Linux kernel’s mac80211 subsystem, which handles wireless networking. The issue arises from improper handling of Read-Copy-Update RCU in the Tunneled Direct Link Setup TDLS fast-xmit function. This flaw can result in using unprotected data structures during execution,...

CVE-2024-26683

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: detect stuck ECSA element in probe resp We recently added some validation that we don't try to connect to an AP that is currently in a channel switch process, since that might want the channel to be quiet or we...

DEBIAN-CVE-2024-26683

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: detect stuck ECSA element in probe resp We recently added some validation that we don't try to connect to an AP that is currently in a channel switch process, since that might want the channel to be quiet or we...

CVE-2024-26682

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: improve CSA/ECSA connection refusal As mentioned in the previous commit, we pretty quickly found that some APs have ECSA elements stuck in their probe response, so using that to not attempt to connect while CSA is...

DEBIAN-CVE-2024-26682

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: improve CSA/ECSA connection refusal As mentioned in the previous commit, we pretty quickly found that some APs have ECSA elements stuck in their probe response, so using that to not attempt to connect while CSA is...

CVE-2024-26666

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix RCU use in TDLS fast-xmit This looks up the link under RCU protection, but isn't guaranteed to actually have protection. Fix that...

DEBIAN-CVE-2024-26666

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix RCU use in TDLS fast-xmit This looks up the link under RCU protection, but isn't guaranteed to actually have protection. Fix that...