In the Linux kernel, the following vulnerability has been resolved:
wifi: mwifiex: Do not return unused priv in mwifiex_get_priv_by_id()
mwifiex_get_priv_by_id() returns the priv pointer corresponding to the bss_num and bss_type, but without checking if the priv is actually currently in use. Unused priv pointers do not have a wiphy attached to them which can lead to NULL pointer dereferences further down the callstack. Fix this by returning only used priv pointers which have priv->bss_mode set to something else than NL80211_IFTYPE_UNSPECIFIED.
Said NULL pointer dereference happened when an Accesspoint was started with wpa_supplicant -i mlan0 with this config:
network={ ssid="somessid" mode=2 frequency=2412 key_mgmt=WPA-PSK WPA-PSK-SHA256 proto=RSN group=CCMP pairwise=CCMP psk="12345678" }
When waiting for the AP to be established, interrupting wpa_supplicant with <ctrl-c> and starting it again this happens:
| Unable to handle kernel NULL pointer dereference at virtual address 0000000000000140 | Mem abort info: | ESR = 0x0000000096000004 | EC = 0x25: DABT (current EL), IL = 32 bits | SET = 0, FnV = 0 | EA = 0, S1PTW = 0 | FSC = 0x04: level 0 translation fault | Data abort info: | ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 | CM = 0, WnR = 0, TnD = 0, TagAccess = 0 | GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 | user pgtable: 4k pages, 48-bit VAs, pgdp=0000000046d96000 | [0000000000000140] pgd=0000000000000000, p4d=0000000000000000 | Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP | Modules linked in: caam_jr caamhash_desc spidev caamalg_desc crypto_engine authenc libdes mwifiex_sdio +mwifiex crct10dif_ce cdc_acm onboard_usb_hub fsl_imx8_ddr_perf imx8m_ddrc rtc_ds1307 lm75 rtc_snvs +imx_sdma caam imx8mm_thermal spi_imx error imx_cpufreq_dt fuse ip_tables x_tables ipv6 | CPU: 0 PID: 8 Comm: kworker/0:1 Not tainted 6.9.0-00007-g937242013fce-dirty #18 | Hardware name: somemachine (DT) | Workqueue: events sdio_irq_work | pstate: 00000005 (nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) | pc : mwifiex_get_cfp+0xd8/0x15c [mwifiex] | lr : mwifiex_get_cfp+0x34/0x15c [mwifiex] | sp : ffff8000818b3a70 | x29: ffff8000818b3a70 x28: ffff000006bfd8a5 x27: 0000000000000004 | x26: 000000000000002c x25: 0000000000001511 x24: 0000000002e86bc9 | x23: ffff000006bfd996 x22: 0000000000000004 x21: ffff000007bec000 | x20: 000000000000002c x19: 0000000000000000 x18: 0000000000000000 | x17: 000000040044ffff x16: 00500072b5503510 x15: ccc283740681e517 | x14: 0201000101006d15 x13: 0000000002e8ff43 x12: 002c01000000ffb1 | x11: 0100000000000000 x10: 02e8ff43002c0100 x9 : 0000ffb100100157 | x8 : ffff000003d20000 x7 : 00000000000002f1 x6 : 00000000ffffe124 | x5 : 0000000000000001 x4 : 0000000000000003 x3 : 0000000000000000 | x2 : 0000000000000000 x1 : 0001000000011001 x0 : 0000000000000000 | Call trace: | mwifiex_get_cfp+0xd8/0x15c [mwifiex] | mwifiex_parse_single_response_buf+0x1d0/0x504 [mwifiex] | mwifiex_handle_event_ext_scan_report+0x19c/0x2f8 [mwifiex] | mwifiex_process_sta_event+0x298/0xf0c [mwifiex] | mwifiex_process_event+0x110/0x238 [mwifiex] | mwifiex_main_process+0x428/0xa44 [mwifiex] | mwifiex_sdio_interrupt+0x64/0x12c [mwifiex_sdio] | process_sdio_pending_irqs+0x64/0x1b8 | sdio_irq_work+0x4c/0x7c | process_one_work+0x148/0x2a0 | worker_thread+0x2fc/0x40c | kthread+0x110/0x114 | ret_from_fork+0x10/0x20 | Code: a94153f3 a8c37bfd d50323bf d65f03c0 (f940a000) | ---[ end trace 0000000000000000 ]---
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-toolsUpgrade kernel-debuginfo-common-aarch64Upgrade bpftool-debuginfoUpgrade kernel-tools-develUpgrade perfUpgrade kernel-livepatch-5.10.226-214.879Upgrade kernel-develUpgrade python-perfUpgrade kernel-tools-debuginfoUpgrade perf-debuginfoUpgrade kernel-headersUpgrade kernel-debuginfo-common-x86_64Upgrade python-perf-debuginfoUpgrade bpftoolUpgrade kernel-livepatch-5.15.167-112.165Upgrade kernelUpgrade kernel-debuginfo | Oct 3, 2024 | Sep 18, 2024 |
| Debian | — | Upgrade linuxUpgrade linux-6.1 | Oct 7, 2024 | Sep 18, 2024 |
| Oracle_linux | — | Upgrade kernel-uek | Nov 21, 2024 | Sep 18, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Sep 18, 2024 |
| Suse | — | Upgrade dtb-armUpgrade dtb-marvellUpgrade kernel-default-baseUpgrade kernel-default-extraUpgrade dtb-apmUpgrade dtb-nvidiaUpgrade kernel-azure-develUpgrade kernel-devel-rtUpgrade kselftests-kmp-rtUpgrade kernel-defaultUpgrade kernel-macrosUpgrade kernel-symsUpgrade reiserfs-kmp-azureUpgrade dtb-mediatekUpgrade kernel-debug-develUpgrade dtb-rockchipUpgrade ocfs2-kmp-rtUpgrade kselftests-kmp-defaultUpgrade kernel-debug-livepatch-develUpgrade cluster-md-kmp-defaultUpgrade kernel-64kb-livepatch-develUpgrade dtb-appleUpgrade kernel-obs-qaUpgrade reiserfs-kmp-rtUpgrade kernel-kvmsmallUpgrade dtb-amdUpgrade kernel-rt-livepatch-develUpgrade dlm-kmp-azureUpgrade kernel-docsUpgrade dtb-amlogicUpgrade kernel-rt_debug-vdsoUpgrade kernel-zfcpdumpUpgrade gfs2-kmp-rtUpgrade kernel-syms-rtUpgrade dtb-socionextUpgrade kernel-kvmsmall-develUpgrade kernel-azure-vdsoUpgrade dlm-kmp-defaultUpgrade kernel-azure-extraUpgrade kernel-azure-livepatch-develUpgrade kernel-default-manUpgrade kernel-kvmsmall-vdsoUpgrade gfs2-kmp-64kbUpgrade kernel-default-livepatch-develUpgrade kernel-rt_debugUpgrade cluster-md-kmp-64kbUpgrade dtb-sprdUpgrade gfs2-kmp-defaultUpgrade kernel-64kbUpgrade kernel-syms-azureUpgrade kernel-rt-vdsoUpgrade reiserfs-kmp-64kbUpgrade ocfs2-kmp-azureUpgrade kernel-rt_debug-develUpgrade kernel-obs-buildUpgrade kernel-default-optionalUpgrade gfs2-kmp-azureUpgrade cluster-md-kmp-azureUpgrade kernel-64kb-optionalUpgrade reiserfs-kmp-defaultUpgrade kernel-sourceUpgrade kernel-default-base-rebuildUpgrade dtb-broadcomUpgrade dtb-amazonUpgrade dtb-allwinnerUpgrade dtb-freescaleUpgrade kernel-devel-azureUpgrade kernel-debug-vdsoUpgrade kernel-source-azureUpgrade dtb-hisiliconUpgrade kernel-source-vanillaUpgrade kernel-debugUpgrade dtb-lgUpgrade kselftests-kmp-64kbUpgrade ocfs2-kmp-defaultUpgrade ocfs2-kmp-64kbUpgrade kernel-develUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-rt-develUpgrade dtb-qcomUpgrade dtb-exynosUpgrade dtb-alteraUpgrade kernel-default-livepatchUpgrade kernel-source-rtUpgrade kernel-rt-livepatchUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-azureUpgrade dtb-caviumUpgrade kernel-rt-extraUpgrade kernel-64kb-extraUpgrade kernel-docs-htmlUpgrade dlm-kmp-rtUpgrade dlm-kmp-64kbUpgrade kernel-rtUpgrade kernel-default-vdsoUpgrade kselftests-kmp-azureUpgrade kernel-rt-optionalUpgrade kernel-default-develUpgrade kernel-azure-optionalUpgrade kernel-64kb-develUpgrade dtb-xilinxUpgrade dtb-renesasUpgrade cluster-md-kmp-rt | Dec 5, 2025 | Oct 8, 2024 |
| Ubuntu | — | Upgrade linux-image-lowlatency-64kUpgrade linux-image-5.4.0-200-lowlatencyUpgrade linux-image-gcp-lts-22.04Upgrade linux-image-5.4.0-1139-gcpUpgrade linux-image-gke-5.15Upgrade linux-image-oracleUpgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-5.15.0-1055-gkeopUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-generic-lpaeUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-gcp-lts-20.04Upgrade linux-image-6.8.0-1002-gkeopUpgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-5.15.0-1067-nvidia-lowlatencyUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-5.4.0-1139-azureUpgrade linux-image-ibm-classicUpgrade linux-image-raspi2Upgrade linux-image-6.8.0-1017-ibmUpgrade linux-image-5.15.0-1067-nvidiaUpgrade linux-image-5.15.0-1038-xilinx-zynqmpUpgrade linux-image-raspi-nolpaeUpgrade linux-image-5.4.0-1082-ibmUpgrade linux-image-oracle-lts-20.04Upgrade linux-image-gkeUpgrade linux-image-5.4.0-1140-azureUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-6.8.0-1019-gcpUpgrade linux-image-5.4.0-1102-gkeopUpgrade linux-image-5.4.0-1123-kvmUpgrade linux-image-6.8.0-1020-awsUpgrade linux-image-azure-lts-20.04Upgrade linux-image-6.8.0-1020-azure-fdeUpgrade linux-image-oem-20.04Upgrade linux-image-6.8.0-50-generic-64kUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-5.15.0-1072-awsUpgrade linux-image-5.4.0-1119-raspiUpgrade linux-image-oem-22.04aUpgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-raspi-hwe-18.04Upgrade linux-image-lowlatency-64k-hwe-24.04Upgrade linux-image-bluefieldUpgrade linux-image-6.8.0-1015-gkeUpgrade linux-image-5.4.0-1054-xilinx-zynqmpUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-virtualUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-oracle-lts-22.04Upgrade linux-image-5.15.0-1065-raspiUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-oem-22.04Upgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-5.15.0-1065-ibmUpgrade linux-image-5.15.0-1069-gkeUpgrade linux-image-lowlatencyUpgrade linux-image-lowlatency-hwe-18.04Upgrade linux-image-5.15.0-125-generic-lpaeUpgrade linux-image-6.8.0-50-lowlatencyUpgrade linux-image-lowlatency-hwe-24.04Upgrade linux-image-azure-cvmUpgrade linux-image-gkeop-6.8Upgrade linux-image-ibmUpgrade linux-image-aws-lts-22.04Upgrade linux-image-6.8.0-1018-oemUpgrade linux-image-awsUpgrade linux-image-oemUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-oem-24.04Upgrade linux-image-raspiUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-virtual-hwe-22.04Upgrade linux-image-nvidia-6.8Upgrade linux-image-intel-iotgUpgrade linux-image-5.15.0-125-generic-64kUpgrade linux-image-kvmUpgrade linux-image-6.8.0-50-lowlatency-64kUpgrade linux-image-virtual-hwe-18.04Upgrade linux-image-oracle-64kUpgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-azure-lts-22.04Upgrade linux-image-5.15.0-1070-oracleUpgrade linux-image-5.15.0-125-genericUpgrade linux-image-oem-20.04dUpgrade linux-image-5.15.0-1075-azureUpgrade linux-image-6.8.0-1016-raspiUpgrade linux-image-ibm-lts-20.04Upgrade linux-image-6.8.0-1017-oracleUpgrade linux-image-oem-osp1Upgrade linux-image-6.8.0-1019-nvidia-64kUpgrade linux-image-intelUpgrade linux-image-azureUpgrade linux-image-5.4.0-1044-iotUpgrade linux-image-generic-64kUpgrade linux-image-5.4.0-200-generic-lpaeUpgrade linux-image-6.8.0-1019-nvidia-lowlatencyUpgrade linux-image-5.15.0-125-lowlatency-64kUpgrade linux-image-5.15.0-1078-azureUpgrade linux-image-5.15.0-1071-gcpUpgrade linux-image-gkeop-5.4Upgrade linux-image-oem-20.04bUpgrade linux-image-5.15.0-125-lowlatencyUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-aws-lts-20.04Upgrade linux-image-nvidiaUpgrade linux-image-generic-hwe-18.04Upgrade linux-image-oem-24.04aUpgrade linux-image-virtual-hwe-20.04Upgrade linux-image-5.4.0-1094-bluefieldUpgrade linux-image-6.8.0-1020-azureUpgrade linux-image-5.15.0-1067-intel-iotgUpgrade linux-image-6.8.0-1017-oracle-64kUpgrade linux-image-nvidia-64kUpgrade linux-image-5.4.0-200-genericUpgrade linux-image-genericUpgrade linux-image-oem-20.04cUpgrade linux-image-gcpUpgrade linux-image-6.8.0-50-genericUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-5.4.0-1135-awsUpgrade linux-image-gkeop-5.15Upgrade linux-image-generic-hwe-20.04Upgrade linux-image-oem-22.04bUpgrade linux-image-gkeopUpgrade linux-image-5.4.0-1134-oracleUpgrade linux-image-oem-22.04dUpgrade linux-image-5.15.0-1069-kvmUpgrade linux-image-azure-fdeUpgrade linux-image-6.8.0-1019-nvidiaUpgrade linux-image-6.8.0-1019-nvidia-lowlatency-64kUpgrade linux-image-oem-22.04cUpgrade linux-image-snapdragon-hwe-18.04 | Nov 4, 2024 | Sep 18, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Sep 18, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub