What’s Vulnerable › Vulnerabilities

CVE-2014-2706

• Severity: high (CVSS 7.1 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 4.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2014-04-14 · updated 2026-06-17
• Weakness: CWE-362

Description

Race condition in the mac80211 subsystem in the Linux kernel before 3.13.7 allows remote attackers to cause a denial of service (system crash) via network traffic that improperly interacts with the WLAN_STA_PS_STA state (aka power-save mode), related to sta_info.c and tx.c.

Affected products

• Linux kernel: before 3.2.56; from 3.3 before 3.4.84; from 3.5 before 3.10.34; from 3.11 before 3.12.15; from 3.13 before 3.13.7 — fixed in 3.10.34, 3.12.15, 3.13.7, 3.2.56, 3.4.84
• Oracle Corporation Oracle Linux: 6, 7
• SUSE Linux Enterprise High Availability Extension: 11-sp3
• Suse Linux Enterprise Desktop: 11-sp3
• SUSE Linux Enterprise: 11-sp3

How to fix

Upgrade to a fixed version: Linux kernel 3.10.34, 3.12.15, 3.13.7, 3.2.56. Check the vendor advisory for mitigations.

References

• http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=1d147bfa64293b2723c4fec50922168658e613ba
• http://linux.oracle.com/errata/ELSA-2014-3052.html
• http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00006.html
• http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00007.html
• http://secunia.com/advisories/60613
• http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.13.7
• http://www.openwall.com/lists/oss-security/2014/04/01/8
• http://www.securityfocus.com/bid/66591
• http://www.securitytracker.com/id/1038201
• https://bugzilla.kernel.org/show_bug.cgi?id=70551#c18
• https://bugzilla.redhat.com/show_bug.cgi?id=1083512
• https://github.com/torvalds/linux/commit/1d147bfa64293b2723c4fec50922168658e613ba

Get alerted when CVE-2014-2706 or the next vulnerability affects your stack