CVE-2024-53055

wifi: iwlwifi: mvm: fix 6 GHz scan construction

MEDIUM
5.5
CVSS Score
Published: November 19, 2024 at 05:19 PM UTC
Updated: June 17, 2026 at 08:08 AM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
MEDIUM5.5
Exploit prediction
EPSS 0.3%
SSVC
No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix 6 GHz scan construction If more than 255 colocated APs exist for the set of all APs found during 2.4/5 GHz scanning, then the 6 GHz scan construction will loop forever since the loop variable has type u8, which can never reach the number found when that's bigger than 255, and is stored in a u32 variable. Also move it into the loops to have a smaller scope. Using a u32 there is fine, we limit the number of APs in the scan list and each has a limit on the number of RNR entries due to the frame size. With a limit of 1000 scan results, a frame size upper bound of 4096 (really it's more like ~2300) and a TBTT entry size of at least 11, we get an upper bound for the number of ~372k, well in the bounds of a u32.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

5.11 ≤ v < 5.15.1715.11 ≤ v < 6.1.1165.11 ≤ v < 6.11.75.11 ≤ v < 6.125.11 ≤ v < 6.6.605.16 ≤ v < 6.1.1166.2 ≤ v < 6.6.606.7 ≤ v < 6.11.76.12 rc16.12 rc26.12 rc36.12 rc46.12 rc5eae94cf82d7456b57fa9fd55c1edb8a726dcc19c
Vendor states this is fixed in 2ac15e5a8f42fed5d90ed9e1197600913678c50f (fixed)
Vendor states this is fixed in 2ccd5badadab2d586e91546bf5af3deda07fef1f (fixed)
Vendor states this is fixed in 7245012f0f496162dd95d888ed2ceb5a35170f1a (fixed)
Vendor states this is fixed in cde8a7eb5c6762264ff0f4433358e0a0d250c875 (fixed)
Vendor states this is fixed in fc621e7a043de346c33bd7ae7e2e0c651d6152ef (fixed)
Vendor states this is fixed in 5.11 (unaffected)
Vendor states this is fixed in 5.15.171 (unaffected)
Vendor states this is fixed in 6.1.116 (unaffected)
Vendor states this is fixed in 6.11.7 (unaffected)
Vendor states this is fixed in 6.12 (unaffected)
Vendor states this is fixed in 6.6.60 (unaffected)

References (6)

Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/2ac15e5a8f42fed5d90ed9e1197600913678c50f
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/2ccd5badadab2d586e91546bf5af3deda07fef1f
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/7245012f0f496162dd95d888ed2ceb5a35170f1a
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/cde8a7eb5c6762264ff0f4433358e0a0d250c875
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/fc621e7a043de346c33bd7ae7e2e0c651d6152ef
Source: af854a3a-2127-422b-91ae-364da2661108
https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

5.5MEDIUMCISA-ADP
Attack Vector
LOCAL
Complexity
LOW
Privileges
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-835

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card