{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-44997","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2024-08-21T05:34:56.672Z","datePublished":"2024-09-04T19:54:42.181Z","dateUpdated":"2026-08-05T11:37:35.201Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T11:37:35.201Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ethernet: mtk_wed: fix use-after-free panic in mtk_wed_setup_tc_block_cb()\n\nWhen there are multiple ap interfaces on one band and with WED on,\nturning the interface down will cause a kernel panic on MT798X.\n\nPreviously, cb_priv was freed in mtk_wed_setup_tc_block() without\nmarking NULL,and mtk_wed_setup_tc_block_cb() didn't check the value, too.\n\nAssign NULL after free cb_priv in mtk_wed_setup_tc_block() and check NULL\nin mtk_wed_setup_tc_block_cb().\n\n----------\nUnable to handle kernel paging request at virtual address 0072460bca32b4f5\nCall trace:\n mtk_wed_setup_tc_block_cb+0x4/0x38\n 0xffffffc0794084bc\n tcf_block_playback_offloads+0x70/0x1e8\n tcf_block_unbind+0x6c/0xc8\n...\n---------"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable path is entered only through local configuration operations (netlink tc qdisc/filter add-delete or bringing the AP interface down), not from received network frames. A remote or Wi-Fi-adjacent peer cannot cause a tc flow-block unbind.\nAC:L - The `kfree(cb_priv)` and the subsequent `tcf_block_playback_offloads()` call using that same pointer are on one uninterrupted code path, so the UAF fires deterministically whenever a filter exists in the block — the commit describes a reliable panic. No condition outside the attacker's control is involved.\nPR:L - Only `CAP_NET_ADMIN` over the netdev's network namespace is required — no capability check exists in the driver itself — and tc qdisc/filter bind-unbind is exactly the class of operation an unprivileged user obtains via `unshare -Urn` once a netdev is delegated to a namespace they own. No init-namespace root privilege is needed by the vulnerable code.\nUI:N - The attacker performs the qdisc/filter or interface-down operation themselves; no action by any other user or victim process is needed.\nS:U - The corruption stays within the kernel's own security authority on the affected host; there is no VM, IOMMU, or sandbox boundary crossed.\nC:H - The freed kmalloc-16 object is re-read as two pointers and then dereferenced (`tc_can_offload(priv->dev)` reads `dev->features`, `hw->eth`/`hw->index` are consumed by `mtk_flow_offload_cmd()`), so heap grooming of the freed slot turns this into an attacker-directed kernel memory read.\nI:H - Use-after-free with controlled pointer contents flowing into `mtk_flow_offload_cmd()` → `mtk_flow_offload_destroy()`, which performs rhashtable manipulation and PPE-entry writes through the corrupted `eth` pointer, giving a write primitive usable for control-flow hijack.\nA:H - The reported symptom is an immediate kernel panic (\"Unable to handle kernel paging request\") on every affected interface teardown, a full denial of service on the router."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/ethernet/mediatek/mtk_wed.c"],"versions":[{"version":"799684448e3e1f57257a6155541e53510488f67b","lessThan":"326a89321f9d5fe399fe6f9ff7c0fc766582a6a0","status":"affected","versionType":"git"},{"version":"799684448e3e1f57257a6155541e53510488f67b","lessThan":"b453a4bbda03aa8741279c360ac82d1c3ac33548","status":"affected","versionType":"git"},{"version":"799684448e3e1f57257a6155541e53510488f67b","lessThan":"db1b4bedb9b97c6d34b03d03815147c04fffe8b4","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/ethernet/mediatek/mtk_wed.c"],"versions":[{"version":"6.2","status":"affected"},{"version":"0","lessThan":"6.2","status":"unaffected","versionType":"semver"},{"version":"6.6.48","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.10.7","lessThanOrEqual":"6.10.*","status":"unaffected","versionType":"semver"},{"version":"6.11","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.2","versionEndExcluding":"6.6.48"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.2","versionEndExcluding":"6.10.7"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.2","versionEndExcluding":"6.11"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/326a89321f9d5fe399fe6f9ff7c0fc766582a6a0"},{"url":"https://git.kernel.org/stable/c/b453a4bbda03aa8741279c360ac82d1c3ac33548"},{"url":"https://git.kernel.org/stable/c/db1b4bedb9b97c6d34b03d03815147c04fffe8b4"}],"title":"net: ethernet: mtk_wed: fix use-after-free panic in mtk_wed_setup_tc_block_cb()","x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-09-04T20:19:10.367821Z","id":"CVE-2024-44997","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2024-09-04T20:19:22.792Z"}}]}}