{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-36922","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2024-05-30T15:25:07.068Z","datePublished":"2024-05-30T15:29:16.852Z","dateUpdated":"2026-08-05T11:32:06.118Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T11:32:06.118Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: read txq->read_ptr under lock\n\nIf we read txq->read_ptr without lock, we can read the same\nvalue twice, then obtain the lock, and reclaim from there\nto two different places, but crucially reclaim the same\nentry twice, resulting in the WARN_ONCE() a little later.\nFix that by reading txq->read_ptr under lock."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:A - The vulnerable reclaim path is driven entirely by over-the-air activity — firmware TX/BA completions for transmitted frames and flush operations triggered by connection-state changes — so an attacker within WiFi radio range (rogue AP or frame injection) can drive it. Per WiFi frame-injection guidance this is Adjacent, not Local.\nAC:L - The attacker controls both sides of the race: sustained traffic keeps TX_CMD/BA_NOTIF reclaims firing in the RX softirq path, while injected deauth/disassoc or channel-switch frames repeatedly trigger the process-context flush reclaim, and the attempt can be retried indefinitely at high rate until the unlocked read is interleaved.\nPR:N - No credentials or authentication are required — deauth/disassoc injection and rogue-AP association handling are pre-authentication, and the reclaim path is exercised by ordinary unauthenticated 802.11 traffic and management frames.\nUI:N - No victim action is needed; an active WiFi connection carrying traffic is the normal operating state, and the flush/completion interleaving happens without any user involvement.\nS:U - The corrupted TX queue state, leaked buffers and resulting crash are all confined to the kernel's own security authority; no VM, IOMMU or sandbox boundary is crossed.\nC:H - The desynchronized read_ptr lets the loop unmap DMA buffers and release skbs for TFDs the firmware still owns, leaving stale valid TFDs in the ring that the device can fetch and transmit, exposing kernel buffer contents over the air; per guidance, memory corruption leverageable for disclosure is High.\nI:H - Premature reclaim tears down DMA mappings and frees buffers still referenced by hardware TFDs, so the device can DMA into unmapped or reallocated memory, and the ring accounting itself is corrupted — a memory-corruption primitive rather than a bounded state error.\nA:H - The bug directly produces WARN_ONCE/WARN_ON splats (a panic under panic_on_warn), and the corrupted read_ptr makes iwl_txq_space() return 0 permanently, wedging the TX queue and triggering the queue-stuck watchdog/firmware restart with loss of connectivity."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/wireless/intel/iwlwifi/queue/tx.c"],"versions":[{"version":"7b3e42ea2eadd41cc9d6363a9813b8ba8ab6f0e6","lessThan":"f30e8af109818c9db08cbcc46eb9713fe4b530ba","status":"affected","versionType":"git"},{"version":"7b3e42ea2eadd41cc9d6363a9813b8ba8ab6f0e6","lessThan":"aab7b39fcac5f6165f6434bcbb56bb7865d4ad2b","status":"affected","versionType":"git"},{"version":"7b3e42ea2eadd41cc9d6363a9813b8ba8ab6f0e6","lessThan":"b83db8e756dec68a950ed2f056248b1704b3deaa","status":"affected","versionType":"git"},{"version":"7b3e42ea2eadd41cc9d6363a9813b8ba8ab6f0e6","lessThan":"43d07103df670484cdd26f9588eabef80f69db89","status":"affected","versionType":"git"},{"version":"7b3e42ea2eadd41cc9d6363a9813b8ba8ab6f0e6","lessThan":"c2ace6300600c634553657785dfe5ea0ed688ac2","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/wireless/intel/iwlwifi/queue/tx.c"],"versions":[{"version":"4.19","status":"affected"},{"version":"0","lessThan":"4.19","status":"unaffected","versionType":"semver"},{"version":"5.15.209","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.175","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.31","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.8.10","lessThanOrEqual":"6.8.*","status":"unaffected","versionType":"semver"},{"version":"6.9","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.19","versionEndExcluding":"5.15.209"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.19","versionEndExcluding":"6.1.175"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.19","versionEndExcluding":"6.6.31"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.19","versionEndExcluding":"6.8.10"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.19","versionEndExcluding":"6.9"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/f30e8af109818c9db08cbcc46eb9713fe4b530ba"},{"url":"https://git.kernel.org/stable/c/aab7b39fcac5f6165f6434bcbb56bb7865d4ad2b"},{"url":"https://git.kernel.org/stable/c/b83db8e756dec68a950ed2f056248b1704b3deaa"},{"url":"https://git.kernel.org/stable/c/43d07103df670484cdd26f9588eabef80f69db89"},{"url":"https://git.kernel.org/stable/c/c2ace6300600c634553657785dfe5ea0ed688ac2"}],"title":"wifi: iwlwifi: read txq->read_ptr under lock","x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-02T03:43:49.981Z"},"title":"CVE Program Container","references":[{"url":"https://git.kernel.org/stable/c/b83db8e756dec68a950ed2f056248b1704b3deaa","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/43d07103df670484cdd26f9588eabef80f69db89","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/c2ace6300600c634553657785dfe5ea0ed688ac2","tags":["x_transferred"]}]},{"metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2024-36922","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2024-09-10T17:16:00.944037Z"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2024-09-11T17:34:59.986Z"}}]}}