|
Vulnerabilities
< Back

CVE-2024-26892

Updated on 17 Apr 2024

Severity

7.8 High severity

Details

CVSS score
7.8
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE ID
Links
NISTCIRCLRHELUbuntu

Overview

About vulnerability

In the Linux kernel, the following vulnerability has been resolved:

wifi: mt76: mt7921e: fix use-after-free in free_irq()

From commit a304e1b82808 ("[PATCH] Debug shared irqs"), there is a test to make sure the shared irq handler should be able to handle the unexpected event after deregistration. For this case, let’s apply MT76_REMOVED flag to indicate the device was removed and do not run into the resource access anymore.

BUG: KASAN: use-after-free in mt7921_irq_handler+0xd8/0x100 [mt7921e] Read of size 8 at addr ffff88824a7d3b78 by task rmmod/11115 CPU: 28 PID: 11115 Comm: rmmod Tainted: G W L 5.17.0 #10 Hardware name: Micro-Star International Co., Ltd. MS-7D73/MPG B650I EDGE WIFI (MS-7D73), BIOS 1.81 01/05/2024 Call Trace: <TASK> dump_stack_lvl+0x6f/0xa0 print_address_description.constprop.0+0x1f/0x190 ? mt7921_irq_handler+0xd8/0x100 [mt7921e] ? mt7921_irq_handler+0xd8/0x100 [mt7921e] kasan_report.cold+0x7f/0x11b ? mt7921_irq_handler+0xd8/0x100 [mt7921e] mt7921_irq_handler+0xd8/0x100 [mt7921e] free_irq+0x627/0xaa0 devm_free_irq+0x94/0xd0 ? devm_request_any_context_irq+0x160/0x160 ? kobject_put+0x18d/0x4a0 mt7921_pci_remove+0x153/0x190 [mt7921e] pci_device_remove+0xa2/0x1d0 __device_release_driver+0x346/0x6e0 driver_detach+0x1ef/0x2c0 bus_remove_driver+0xe7/0x2d0 ? __check_object_size+0x57/0x310 pci_unregister_driver+0x26/0x250 __do_sys_delete_module+0x307/0x510 ? free_module+0x6a0/0x6a0 ? fpregs_assert_state_consistent+0x4b/0xb0 ? rcu_read_lock_sched_held+0x10/0x70 ? syscall_enter_from_user_mode+0x20/0x70 ? trace_hardirqs_on+0x1c/0x130 do_syscall_64+0x5c/0x80 ? trace_hardirqs_on_prepare+0x72/0x160 ? do_syscall_64+0x68/0x80 ? trace_hardirqs_on_prepare+0x72/0x160 entry_SYSCALL_64_after_hwframe+0x44/0xae

Details

Affected product:
AlmaLinux 9.2 ESU , CentOS 6 ELS , CentOS 7 ELS , CentOS 8.4 ELS , CentOS 8.5 ELS , CentOS Stream 8 ELS , CloudLinux 6 ELS , Oracle Linux 6 ELS , TuxCare 9.6 ESU
Affected packages:
kernel @ 2.6.32 (+8 more)

Fixes

KernelCare state

Live-patch status from KernelCare for each operating system.

Operating system Status Covered kernels
AlmaLinux 8 Released
30 kernels
  • 4.18.0-348.12.2.el8_5
  • 4.18.0-348.2.1.el8_5
  • 4.18.0-348.20.1.el8.fscrypt
  • 4.18.0-348.20.1.el8_5
  • 4.18.0-348.23.1.el8_5
  • 4.18.0-348.7.1.el8_5
  • 4.18.0-348.el8
  • 4.18.0-372.13.1.el8_6
  • 4.18.0-372.16.1.el8_6
  • 4.18.0-372.19.1.el8_6
  • 4.18.0-372.26.1.el8_6
  • 4.18.0-372.32.1.el8_6
  • 4.18.0-372.9.1.el8
  • 4.18.0-425.10.1.el8_7
  • 4.18.0-425.13.1.el8_7
  • 4.18.0-425.19.2.el8_7
  • 4.18.0-425.3.1.el8
  • 4.18.0-477.10.1.el8_8
  • 4.18.0-477.13.1.el8_8
  • 4.18.0-477.15.1.el8_8
  • 4.18.0-477.21.1.el8_8
  • 4.18.0-477.27.1.el8_8
  • 4.18.0-477.27.2.el8_8
  • 4.18.0-513.11.1.el8_9
  • 4.18.0-513.18.1.el8_9
  • 4.18.0-513.18.2.el8_9
  • 4.18.0-513.24.1.el8_9
  • 4.18.0-513.5.1.el8_9
  • 4.18.0-513.9.1.el8_9
  • 4.18.0-553.el8_10
AlmaLinux 9 Released
33 kernels
  • 5.14.0-162.12.1.el9_1
  • 5.14.0-162.18.1.el9_1
  • 5.14.0-162.22.2.el9_1
  • 5.14.0-162.23.1.el9_1
  • 5.14.0-162.6.1.el9_1
  • 5.14.0-284.11.1.el9_2
  • 5.14.0-284.18.1.el9_2
  • 5.14.0-284.25.1.el9_2
  • 5.14.0-284.30.1.el9_2
  • 5.14.0-362.13.1.el9_3
  • 5.14.0-362.18.1.el9_3
  • 5.14.0-362.24.1.el9_3
  • 5.14.0-362.8.1.el9_3
  • 5.14.0-427.13.1.el9_4
  • 5.14.0-427.16.1.el9_4
  • 5.14.0-427.18.1.el9_4
  • 5.14.0-427.20.1.el9_4
  • 5.14.0-427.28.1.el9_4
  • 5.14.0-427.31.1.el9_4
  • 5.14.0-427.33.1.el9_4
  • 5.14.0-427.35.1.el9_4
  • 5.14.0-427.37.1.el9_4
  • 5.14.0-427.40.1.el9_4
  • 5.14.0-427.42.1.el9_4
  • 5.14.0-70.13.1.el9_0
  • 5.14.0-70.17.1.el9_0
  • 5.14.0-70.22.1.el9_0
  • 5.14.0-70.26.1.el9_0
  • 5.14.0-70.30.1.el9_0
  • 5.14.0-362.24.2.el9_3
  • 5.14.0-427.22.1.el9_4
  • 5.14.0-427.24.1.el9_4
  • 5.14.0-427.26.1.el9_4
CentOS 8 Released
3 kernels
  • 4.18.0-348.2.1.el8_5
  • 4.18.0-348.7.1.el8_5
  • 4.18.0-348.el8
CloudLinux OS 7h Released
41 kernels
  • 4.18.0-348.12.2.lve.1.el7h
  • 4.18.0-348.12.2.lve.2.el7h
  • 4.18.0-348.12.2.lve.el7h
  • 4.18.0-348.20.1.lve.1.el7h
  • 4.18.0-348.20.1.lve.el7h
  • 4.18.0-348.23.1.lve.el7h
  • 4.18.0-348.7.1.lve.el7h
  • 4.18.0-348.lve.el7h
  • 4.18.0-372.13.1.lve.el7h
  • 4.18.0-372.16.1.lve.el7h
  • 4.18.0-372.19.1.lve.el7h
  • 4.18.0-372.26.1.lve.1.el7h
  • 4.18.0-372.32.1.lve.el7h
  • 4.18.0-372.9.1.lve.el7h
  • 4.18.0-425.10.1.lve.el7h
  • 4.18.0-425.13.1.lve.el7h
  • 4.18.0-425.19.2.lve.el7h
  • 4.18.0-425.3.1.lve.1.el7h
  • 4.18.0-425.3.1.lve.2.el7h
  • 4.18.0-425.3.1.lve.3.el7h
  • 4.18.0-425.3.1.lve.el7h
  • 4.18.0-477.10.1.lve.1.el7h
  • 4.18.0-477.13.1.lve.1.el7h
  • 4.18.0-477.13.1.lve.el7h
  • 4.18.0-477.15.1.lve.1.el7h
  • 4.18.0-477.15.1.lve.2.el7h
  • 4.18.0-477.21.1.lve.1.el7h
  • 4.18.0-477.21.1.lve.el7h
  • 4.18.0-477.27.1.lve.el7h
  • 4.18.0-477.27.2.lve.el7h
  • 4.18.0-513.11.1.lve.1.el7h
  • 4.18.0-513.11.1.lve.el7h
  • 4.18.0-513.18.1.lve.1.el7h
  • 4.18.0-513.18.1.lve.2.el7h
  • 4.18.0-513.18.1.lve.el7h
  • 4.18.0-513.24.1.lve.1.el7h
  • 4.18.0-513.24.1.lve.2.el7h
  • 4.18.0-513.24.1.lve.el7h
  • 4.18.0-513.5.1.lve.el7h
  • 4.18.0-513.9.1.lve.el7h
  • 4.18.0-553.lve.el7h
CloudLinux OS 8 Released
39 kernels
  • 4.18.0-544.lve.el8
  • 4.18.0-513.18.1.lve.el8
  • 4.18.0-513.24.1.lve.1.el8
  • 4.18.0-513.24.1.lve.2.el8
  • 4.18.0-513.24.1.lve.el8
  • 4.18.0-553.lve.el8
  • 4.18.0-348.12.2.lve.el8
  • 4.18.0-348.20.1.lve.1.el8
  • 4.18.0-348.20.1.lve.el8
  • 4.18.0-348.23.1.lve.el8
  • 4.18.0-348.7.1.lve.el8
  • 4.18.0-348.lve.el8
  • 4.18.0-372.13.1.lve.el8
  • 4.18.0-372.16.1.lve.el8
  • 4.18.0-372.19.1.lve.el8
  • 4.18.0-372.26.1.lve.1.el8
  • 4.18.0-372.32.1.lve.el8
  • 4.18.0-372.9.1.1.lve.el8
  • 4.18.0-372.9.1.lve.el8
  • 4.18.0-425.10.1.lve.el8
  • 4.18.0-425.13.1.lve.el8
  • 4.18.0-425.19.2.lve.el8
  • 4.18.0-425.3.1.lve.1.el8
  • 4.18.0-425.3.1.lve.2.el8
  • 4.18.0-425.3.1.lve.3.el8
  • 4.18.0-425.3.1.lve.el8
  • 4.18.0-477.10.1.lve.el8
  • 4.18.0-477.13.1.lve.1.el8
  • 4.18.0-477.13.1.lve.el8
  • 4.18.0-477.15.1.lve.2.el8
  • 4.18.0-477.21.1.lve.1.el8
  • 4.18.0-477.21.1.lve.el8
  • 4.18.0-477.27.1.lve.el8
  • 4.18.0-477.27.2.lve.el8
  • 4.18.0-513.11.1.lve.el8
  • 4.18.0-513.18.1.lve.1.el8
  • 4.18.0-513.18.1.lve.2.el8
  • 4.18.0-513.5.1.lve.el8
  • 4.18.0-513.9.1.lve.el8
Oracle Linux 8 Released
31 kernels
  • 4.18.0-348.12.2.el8_5
  • 4.18.0-348.2.1.el8_5
  • 4.18.0-348.20.1.el8_5
  • 4.18.0-348.23.1.el8_5
  • 4.18.0-348.7.1.el8_5
  • 4.18.0-348.el8
  • 4.18.0-372.13.1.0.1.el8_6
  • 4.18.0-372.16.1.0.1.el8_6
  • 4.18.0-372.19.1.0.1.el8_6
  • 4.18.0-372.26.1.0.1.el8_6
  • 4.18.0-372.32.1.0.1.el8_6
  • 4.18.0-372.9.1.el8
  • 4.18.0-425.10.1.el8_7
  • 4.18.0-425.13.1.el8_7
  • 4.18.0-425.19.2.el8_7
  • 4.18.0-425.3.1.el8
  • 4.18.0-477.10.1.el8_8
  • 4.18.0-477.13.1.el8_8
  • 4.18.0-477.15.1.el8_8
  • 4.18.0-477.21.1.el8_8
  • 4.18.0-477.27.0.1.el8_8
  • 4.18.0-477.27.1.el8_8
  • 4.18.0-513.11.0.1.el8_9
  • 4.18.0-513.18.0.1.el8_9
  • 4.18.0-513.18.0.2.el8_9
  • 4.18.0-513.18.1.0.1.el8_9
  • 4.18.0-513.18.1.el8_9
  • 4.18.0-513.24.1.el8_9
  • 4.18.0-513.5.1.el8_9
  • 4.18.0-513.9.1.el8_9
  • 4.18.0-553.el8_10
Oracle Linux 9 Released
39 kernels
  • 5.14.0-362.24.1.el9_3
  • 5.14.0-362.8.1.el9_3
  • 5.14.0-70.13.1.0.3.el9_0
  • 5.14.0-70.17.1.0.1.el9_0
  • 5.14.0-70.22.1.0.1.el9_0
  • 5.14.0-162.12.1.el9_1
  • 5.14.0-162.18.1.el9_1
  • 5.14.0-162.22.2.el9_1
  • 5.14.0-162.23.1.el9_1
  • 5.14.0-162.6.1.el9_1
  • 5.14.0-284.11.1.el9_2
  • 5.14.0-284.18.1.el9_2
  • 5.14.0-284.25.1.0.1.el9_2
  • 5.14.0-284.25.1.el9_2
  • 5.14.0-284.30.0.1.el9_2
  • 5.14.0-284.30.1.el9_2
  • 5.14.0-362.13.0.1.el9_3
  • 5.14.0-362.13.1.el9_3
  • 5.14.0-362.18.0.1.el9_3
  • 5.14.0-362.18.0.2.el9_3
  • 5.14.0-362.18.1.el9_3
  • 5.14.0-362.24.1.0.1.el9_3
  • 5.14.0-362.24.1.0.2.el9_3
  • 5.14.0-427.13.1.el9_4
  • 5.14.0-427.16.1.el9_4
  • 5.14.0-427.18.1.el9_4
  • 5.14.0-427.20.1.el9_4
  • 5.14.0-427.22.1.el9_4
  • 5.14.0-427.24.1.el9_4
  • 5.14.0-427.26.1.el9_4
  • 5.14.0-427.28.1.el9_4
  • 5.14.0-427.31.1.el9_4
  • 5.14.0-427.33.1.el9_4
  • 5.14.0-427.35.1.el9_4
  • 5.14.0-427.37.1.el9_4
  • 5.14.0-427.40.1.el9_4
  • 5.14.0-427.42.1.el9_4
  • 5.14.0-70.26.1.0.1.el9_0
  • 5.14.0-70.30.1.0.1.el9_0
RHEL 8 Released
27 kernels
  • 4.18.0-348.12.2.el8_5
  • 4.18.0-348.2.1.el8_5
  • 4.18.0-348.20.1.el8_5
  • 4.18.0-348.23.1.el8_5
  • 4.18.0-348.7.1.el8_5
  • 4.18.0-348.el8
  • 4.18.0-372.13.1.el8_6
  • 4.18.0-372.16.1.el8_6
  • 4.18.0-372.19.1.el8_6
  • 4.18.0-372.26.1.el8_6
  • 4.18.0-372.32.1.el8_6
  • 4.18.0-372.9.1.el8
  • 4.18.0-425.10.1.el8_7
  • 4.18.0-425.13.1.el8_7
  • 4.18.0-425.19.2.el8_7
  • 4.18.0-425.3.1.el8
  • 4.18.0-477.10.1.el8_8
  • 4.18.0-477.13.1.el8_8
  • 4.18.0-477.15.1.el8_8
  • 4.18.0-477.21.1.el8_8
  • 4.18.0-477.27.1.el8_8
  • 4.18.0-513.11.1.el8_9
  • 4.18.0-513.18.1.el8_9
  • 4.18.0-513.24.1.el8_9
  • 4.18.0-513.5.1.el8_9
  • 4.18.0-513.9.1.el8_9
  • 4.18.0-553.el8_10
RHEL 9 Released
33 kernels
  • 5.14.0-162.12.1.el9_1
  • 5.14.0-162.18.1.el9_1
  • 5.14.0-162.22.2.el9_1
  • 5.14.0-162.23.1.el9_1
  • 5.14.0-162.6.1.el9_1
  • 5.14.0-284.11.1.el9_2
  • 5.14.0-284.18.1.el9_2
  • 5.14.0-284.25.1.el9_2
  • 5.14.0-284.30.1.el9_2
  • 5.14.0-362.13.1.el9_3
  • 5.14.0-362.18.1.el9_3
  • 5.14.0-362.24.1.el9_3
  • 5.14.0-362.8.1.el9_3
  • 5.14.0-427.13.1.el9_4
  • 5.14.0-427.16.1.el9_4
  • 5.14.0-427.20.1.el9_4
  • 5.14.0-427.22.1.el9_4
  • 5.14.0-427.24.1.el9_4
  • 5.14.0-427.26.1.el9_4
  • 5.14.0-427.28.1.el9_4
  • 5.14.0-427.31.1.el9_4
  • 5.14.0-427.33.1.el9_4
  • 5.14.0-427.35.1.el9_4
  • 5.14.0-427.37.1.el9_4
  • 5.14.0-427.40.1.el9_4
  • 5.14.0-427.42.1.el9_4
  • 5.14.0-70.13.1.el9_0
  • 5.14.0-70.17.1.el9_0
  • 5.14.0-70.22.1.el9_0
  • 5.14.0-70.26.1.el9_0
  • 5.14.0-70.30.1.el9_0
  • 5.14.0-70.5.1.el9_0
  • 5.14.0-427.18.1.el9_4
Rocky Linux 8 Released
28 kernels
  • 4.18.0-348.12.2.el8_5
  • 4.18.0-348.2.1.el8_5
  • 4.18.0-348.20.1.el8_5
  • 4.18.0-348.23.1.el8_5
  • 4.18.0-348.7.1.el8_5
  • 4.18.0-372.13.1.el8_6
  • 4.18.0-372.16.1.el8_6.0.1
  • 4.18.0-372.16.1.el8_6
  • 4.18.0-372.19.1.el8_6
  • 4.18.0-372.26.1.el8_6
  • 4.18.0-372.32.1.el8_6
  • 4.18.0-372.9.1.el8
  • 4.18.0-425.10.1.el8_7
  • 4.18.0-425.13.1.el8_7
  • 4.18.0-425.19.2.el8_7
  • 4.18.0-425.3.1.el8
  • 4.18.0-477.10.1.el8_8
  • 4.18.0-477.13.1.el8_8
  • 4.18.0-477.15.1.el8_8
  • 4.18.0-477.21.1.el8_8
  • 4.18.0-477.27.1.el8_8
  • 4.18.0-513.11.1.el8_9.0.1
  • 4.18.0-513.11.1.el8_9
  • 4.18.0-513.18.1.el8_9
  • 4.18.0-513.24.1.el8_9
  • 4.18.0-513.5.1.el8_9
  • 4.18.0-513.9.1.el8_9
  • 4.18.0-553.el8_10
Rocky Linux 9 Released
33 kernels
  • 5.14.0-162.12.1.el9_1.0.1
  • 5.14.0-162.12.1.el9_1.0.2
  • 5.14.0-162.18.1.el9_1
  • 5.14.0-162.22.2.el9_1
  • 5.14.0-162.23.1.el9_1
  • 5.14.0-162.6.1.el9_1.0.1
  • 5.14.0-162.6.1.el9_1
  • 5.14.0-284.30.1.el9_2
  • 5.14.0-362.13.1.el9_3
  • 5.14.0-362.18.1.el9_3.0.1
  • 5.14.0-362.18.1.el9_3
  • 5.14.0-362.24.1.el9_3.0.1
  • 5.14.0-362.24.1.el9_3
  • 5.14.0-362.8.1.el9_3
  • 5.14.0-427.16.1.el9_4
  • 5.14.0-427.18.1.el9_4
  • 5.14.0-427.20.1.el9_4.0.1
  • 5.14.0-427.20.1.el9_4
  • 5.14.0-427.22.1.el9_4
  • 5.14.0-427.24.1.el9_4
  • 5.14.0-427.26.1.el9_4
  • 5.14.0-427.28.1.el9_4
  • 5.14.0-427.31.1.el9_4
  • 5.14.0-427.33.1.el9_4
  • 5.14.0-427.35.1.el9_4
  • 5.14.0-427.37.1.el9_4
  • 5.14.0-427.40.1.el9_4
  • 5.14.0-427.42.1.el9_4
  • 5.14.0-70.22.1.el9_0
  • 5.14.0-70.26.1.el9_0
  • 5.14.0-70.30.1.el9_0
  • 5.14.0-284.11.1.el9_2
  • 5.14.0-427.13.1.el9_4
Ubuntu 24.04 Released
1 kernel
  • 6.8.0-31.31