GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-53189 (GCVE-0-2024-53189)

Vulnerability from cvelistv5 – Published: 2024-12-27 13:49 – Updated: 2026-05-11 20:52
VLAI
Title
wifi: nl80211: fix bounds checker error in nl80211_parse_sched_scan
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: fix bounds checker error in nl80211_parse_sched_scan The channels array in the cfg80211_scan_request has a __counted_by attribute attached to it, which points to the n_channels variable. This attribute is used in bounds checking, and if it is not set before the array is filled, then the bounds sanitizer will issue a warning or a kernel panic if CONFIG_UBSAN_TRAP is set. This patch sets the size of allocated memory as the initial value for n_channels. It is updated with the actual number of added elements after the array is filled.
Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: aa4ec06c455d0200eea0a4361cc58eb5b8bf68c4 , < d4ef643ea78c59c22546046c25dc6e7206267672 (git)
Affected: aa4ec06c455d0200eea0a4361cc58eb5b8bf68c4 , < 1a7b62ddf2c7642878c24f0e556041bb58c37527 (git)
Affected: aa4ec06c455d0200eea0a4361cc58eb5b8bf68c4 , < 9c46a3a5b394d6d123866aa44436fc2cd342eb0d (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.11
Unaffected: 0 , < 6.11 (semver)
Unaffected: 6.11.11 , ≤ 6.11.* (semver)
Unaffected: 6.12.2 , ≤ 6.12.* (semver)
Unaffected: 6.13 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/wireless/nl80211.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d4ef643ea78c59c22546046c25dc6e7206267672",
              "status": "affected",
              "version": "aa4ec06c455d0200eea0a4361cc58eb5b8bf68c4",
              "versionType": "git"
            },
            {
              "lessThan": "1a7b62ddf2c7642878c24f0e556041bb58c37527",
              "status": "affected",
              "version": "aa4ec06c455d0200eea0a4361cc58eb5b8bf68c4",
              "versionType": "git"
            },
            {
              "lessThan": "9c46a3a5b394d6d123866aa44436fc2cd342eb0d",
              "status": "affected",
              "version": "aa4ec06c455d0200eea0a4361cc58eb5b8bf68c4",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/wireless/nl80211.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.11"
            },
            {
              "lessThan": "6.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.11",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.2",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: nl80211: fix bounds checker error in nl80211_parse_sched_scan\n\nThe channels array in the cfg80211_scan_request has a __counted_by\nattribute attached to it, which points to the n_channels variable. This\nattribute is used in bounds checking, and if it is not set before the\narray is filled, then the bounds sanitizer will issue a warning or a\nkernel panic if CONFIG_UBSAN_TRAP is set.\n\nThis patch sets the size of allocated memory as the initial value for\nn_channels. It is updated with the actual number of added elements after\nthe array is filled."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T20:52:33.954Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d4ef643ea78c59c22546046c25dc6e7206267672"
        },
        {
          "url": "https://git.kernel.org/stable/c/1a7b62ddf2c7642878c24f0e556041bb58c37527"
        },
        {
          "url": "https://git.kernel.org/stable/c/9c46a3a5b394d6d123866aa44436fc2cd342eb0d"
        }
      ],
      "title": "wifi: nl80211: fix bounds checker error in nl80211_parse_sched_scan",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-53189",
    "datePublished": "2024-12-27T13:49:31.889Z",
    "dateReserved": "2024-11-19T17:17:25.013Z",
    "dateUpdated": "2026-05-11T20:52:33.954Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-53189",
      "date": "2026-09-16",
      "epss": "0.00226",
      "percentile": "0.1348"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: nl80211: fix bounds checker error in nl80211_parse_sched_scan\\n\\nThe channels array in the cfg80211_scan_request has a __counted_by\\nattribute attached to it, which points to the n_channels variable. This\\nattribute is used in bounds checking, and if it is not set before the\\narray is filled, then the bounds sanitizer will issue a warning or a\\nkernel panic if CONFIG_UBSAN_TRAP is set.\\n\\nThis patch sets the size of allocated memory as the initial value for\\nn_channels. It is updated with the actual number of added elements after\\nthe array is filled.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: wifi: nl80211: fix bounds checker error in nl80211_parse_sched_scan La matriz channels en cfg80211_scan_request tiene un atributo __counted_by adjunto, que apunta a la variable n_channels. Este atributo se utiliza en la comprobaci\\u00f3n de los l\\u00edmites y, si no se configura antes de que se complete la matriz, el desinfectante de los l\\u00edmites emitir\\u00e1 una advertencia o un p\\u00e1nico del kernel si se configura CONFIG_UBSAN_TRAP. Este parche establece el tama\\u00f1o de la memoria asignada como el valor inicial para n_channels. Se actualiza con el n\\u00famero real de elementos agregados despu\\u00e9s de que se complete la matriz.\"}]",
      "id": "CVE-2024-53189",
      "lastModified": "2024-12-27T14:15:26.400",
      "published": "2024-12-27T14:15:26.400",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/1a7b62ddf2c7642878c24f0e556041bb58c37527\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/9c46a3a5b394d6d123866aa44436fc2cd342eb0d\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/d4ef643ea78c59c22546046c25dc6e7206267672\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-53189\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-12-27T14:15:26.400\",\"lastModified\":\"2026-06-17T08:08:32.600\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: nl80211: fix bounds checker error in nl80211_parse_sched_scan\\n\\nThe channels array in the cfg80211_scan_request has a __counted_by\\nattribute attached to it, which points to the n_channels variable. This\\nattribute is used in bounds checking, and if it is not set before the\\narray is filled, then the bounds sanitizer will issue a warning or a\\nkernel panic if CONFIG_UBSAN_TRAP is set.\\n\\nThis patch sets the size of allocated memory as the initial value for\\nn_channels. It is updated with the actual number of added elements after\\nthe array is filled.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: wifi: nl80211: fix bounds checker error in nl80211_parse_sched_scan La matriz channels en cfg80211_scan_request tiene un atributo __counted_by adjunto, que apunta a la variable n_channels. Este atributo se utiliza en la comprobaci\u00f3n de los l\u00edmites y, si no se configura antes de que se complete la matriz, el desinfectante de los l\u00edmites emitir\u00e1 una advertencia o un p\u00e1nico del kernel si se configura CONFIG_UBSAN_TRAP. Este parche establece el tama\u00f1o de la memoria asignada como el valor inicial para n_channels. Se actualiza con el n\u00famero real de elementos agregados despu\u00e9s de que se complete la matriz.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/wireless/nl80211.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"aa4ec06c455d0200eea0a4361cc58eb5b8bf68c4\",\"lessThan\":\"d4ef643ea78c59c22546046c25dc6e7206267672\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"aa4ec06c455d0200eea0a4361cc58eb5b8bf68c4\",\"lessThan\":\"1a7b62ddf2c7642878c24f0e556041bb58c37527\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"aa4ec06c455d0200eea0a4361cc58eb5b8bf68c4\",\"lessThan\":\"9c46a3a5b394d6d123866aa44436fc2cd342eb0d\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/wireless/nl80211.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.11\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.11\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.11.11\",\"lessThanOrEqual\":\"6.11.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.2\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.13\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.11\",\"versionEndExcluding\":\"6.11.11\",\"matchCriteriaId\":\"07BE5DA1-4C04-4052-9B58-6EDE15469D65\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.12\",\"versionEndExcluding\":\"6.12.2\",\"matchCriteriaId\":\"D8882B1B-2ABC-4838-AC1D-DBDBB5764776\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1a7b62ddf2c7642878c24f0e556041bb58c37527\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9c46a3a5b394d6d123866aa44436fc2cd342eb0d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d4ef643ea78c59c22546046c25dc6e7206267672\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2025-11-21T10:42:32+00:00",
      "cve": "CVE-2024-53189",
      "id": "CVE-2024-53189",
      "initial_release_date": "2024-12-27T00:00:00+00:00",
      "product_status:known_affected": "150",
      "product_status:known_not_affected": "48",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: wifi: nl80211: fix bounds checker error in nl80211_parse_sched_scan",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-53189.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-03T00:19:40Z",
      "cve": "CVE-2024-53189",
      "id": "CVE-2024-53189",
      "initial_release_date": "2024-12-28T03:50:36Z",
      "product_status:known_not_affected": "546",
      "product_status:recommended": "125",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-53189",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-53189.json",
      "version": "30"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.