What’s Vulnerable › Vulnerabilities

CVE-2024-35912: wifi: iwlwifi: mvm: rfi: fix potential response leaks

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-05-19 · updated 2026-06-17
• Weakness: CWE-401

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: rfi: fix potential response leaks If the rx payload length check fails, or if kmemdup() fails, we still need to free the command response. Fix that.

Affected products

• Linux kernel: from 5.12 before 5.15.154; from 5.16 before 6.1.85; from 6.2 before 6.6.26; from 6.7 before 6.8.5; 6.9-rc1 — fixed in 5.15.154, 6.1.85, 6.6.26, 6.8.5

How to fix

Upgrade to a fixed version: Linux kernel 5.15.154, 6.1.85, 6.6.26, 6.8.5. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/06a093807eb7b5c5b29b6cff49f8174a4e702341
• https://git.kernel.org/stable/c/28db0ae86cb91a4ab0e855cff779daead936b7d5
• https://git.kernel.org/stable/c/99a75d75007421d8e08ba139e24f77395cd08f62
• https://git.kernel.org/stable/c/c0a40f2f8eba07416f695ffe2011bf3f8b0b6dc8
• https://git.kernel.org/stable/c/f7f0e784894dfcb265f0f9fa499103b0ca7eabde
• https://git.kernel.org/stable/c/06a093807eb7b5c5b29b6cff49f8174a4e702341
• https://git.kernel.org/stable/c/28db0ae86cb91a4ab0e855cff779daead936b7d5
• https://git.kernel.org/stable/c/99a75d75007421d8e08ba139e24f77395cd08f62
• https://git.kernel.org/stable/c/c0a40f2f8eba07416f695ffe2011bf3f8b0b6dc8
• https://git.kernel.org/stable/c/f7f0e784894dfcb265f0f9fa499103b0ca7eabde

Get alerted when CVE-2024-35912 or the next vulnerability affects your stack