CVE-2024-35912

wifi: iwlwifi: mvm: rfi: fix potential response leaks

MEDIUM

5.5

CVSS Score

Published: May 19, 2024 at 08:35 AM UTC

Updated: June 17, 2026 at 07:35 AM UTC

1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM5.5

Exploit prediction

EPSS 0.2%

SSVC

No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: rfi: fix potential response leaks If the rx payload length check fails, or if kmemdup() fails, we still need to free the command response. Fix that.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel · Linux

95%

5.12 ≤ v < 5.15.1545.12 ≤ v < 6.1.855.12 ≤ v < 6.6.265.12 ≤ v < 6.8.55.12 ≤ v < 6.95.16 ≤ v < 6.1.856.2 ≤ v < 6.6.266.7 ≤ v < 6.8.521254908cbe995a3982a23da32c30d1b434670435.12 6.9 rc1

Vendor states this is fixed in 06a093807eb7b5c5b29b6cff49f8174a4e702341 (fixed)

Vendor states this is fixed in 28db0ae86cb91a4ab0e855cff779daead936b7d5 (fixed)

Vendor states this is fixed in 99a75d75007421d8e08ba139e24f77395cd08f62 (fixed)

Vendor states this is fixed in c0a40f2f8eba07416f695ffe2011bf3f8b0b6dc8 (fixed)

Vendor states this is fixed in f7f0e784894dfcb265f0f9fa499103b0ca7eabde (fixed)

Vendor states this is fixed in 5.12 (unaffected)

Vendor states this is fixed in 5.15.154 (unaffected)

Vendor states this is fixed in 6.1.85 (unaffected)

Vendor states this is fixed in 6.6.26 (unaffected)

Vendor states this is fixed in 6.8.5 (unaffected)

Vendor states this is fixed in 6.9 (unaffected)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references