What’s Vulnerable › Vulnerabilities

CVE-2024-27052: wifi: rtl8xxxu: add cancel_work_sync() for c2hcmd_work

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-05-01 · updated 2026-10-15
• Weakness: CWE-416

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: rtl8xxxu: add cancel_work_sync() for c2hcmd_work The workqueue might still be running, when the driver is stopped. To avoid a use-after-free, call cancel_work_sync() in rtl8xxxu_stop().

Affected products

• Debian Linux: 10.0
• Linux kernel: from 5.5 before 5.10.214; from 5.11 before 5.15.153; from 5.16 before 6.1.83; from 6.2 before 6.6.23; from 6.7 before 6.7.11; from 6.8 before 6.8.2 — fixed in 5.10.214, 5.15.153, 6.1.83, 6.6.23, 6.7.11, 6.8.2

How to fix

Upgrade to a fixed version: Linux kernel 5.10.214, 5.15.153, 6.1.83, 6.6.23. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/1213acb478a7181cd73eeaf00db430f1e45b1361
• https://git.kernel.org/stable/c/156012667b85ca7305cb363790d3ae8519a6f41e
• https://git.kernel.org/stable/c/3518cea837de4d106efa84ddac18a07b6de1384e
• https://git.kernel.org/stable/c/58fe3bbddfec10c6b216096d8c0e517cd8463e3a
• https://git.kernel.org/stable/c/7059cdb69f8e1a2707dd1e2f363348b507ed7707
• https://git.kernel.org/stable/c/ac512507ac89c01ed6cd4ca53032f52cdb23ea59
• https://git.kernel.org/stable/c/dddedfa3b29a63c2ca4336663806a6128b8545b4
• https://git.kernel.org/stable/c/1213acb478a7181cd73eeaf00db430f1e45b1361
• https://git.kernel.org/stable/c/156012667b85ca7305cb363790d3ae8519a6f41e
• https://git.kernel.org/stable/c/3518cea837de4d106efa84ddac18a07b6de1384e
• https://git.kernel.org/stable/c/58fe3bbddfec10c6b216096d8c0e517cd8463e3a
• https://git.kernel.org/stable/c/7059cdb69f8e1a2707dd1e2f363348b507ed7707

Get alerted when CVE-2024-27052 or the next vulnerability affects your stack