GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-56599 (GCVE-0-2024-56599)

Vulnerability from cvelistv5 – Published: 2024-12-27 14:51 – Updated: 2026-05-11 20:55
VLAI
Title
wifi: ath10k: avoid NULL pointer error during sdio remove
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: ath10k: avoid NULL pointer error during sdio remove When running 'rmmod ath10k', ath10k_sdio_remove() will free sdio workqueue by destroy_workqueue(). But if CONFIG_INIT_ON_FREE_DEFAULT_ON is set to yes, kernel panic will happen: Call trace: destroy_workqueue+0x1c/0x258 ath10k_sdio_remove+0x84/0x94 sdio_bus_remove+0x50/0x16c device_release_driver_internal+0x188/0x25c device_driver_detach+0x20/0x2c This is because during 'rmmod ath10k', ath10k_sdio_remove() will call ath10k_core_destroy() before destroy_workqueue(). wiphy_dev_release() will finally be called in ath10k_core_destroy(). This function will free struct cfg80211_registered_device *rdev and all its members, including wiphy, dev and the pointer of sdio workqueue. Then the pointer of sdio workqueue will be set to NULL due to CONFIG_INIT_ON_FREE_DEFAULT_ON. After device release, destroy_workqueue() will use NULL pointer then the kernel panic happen. Call trace: ath10k_sdio_remove ->ath10k_core_unregister …… ->ath10k_core_stop ->ath10k_hif_stop ->ath10k_sdio_irq_disable ->ath10k_hif_power_down ->del_timer_sync(&ar_sdio->sleep_timer) ->ath10k_core_destroy ->ath10k_mac_destroy ->ieee80211_free_hw ->wiphy_free …… ->wiphy_dev_release ->destroy_workqueue Need to call destroy_workqueue() before ath10k_core_destroy(), free the work queue buffer first and then free pointer of work queue by ath10k_core_destroy(). This order matches the error path order in ath10k_sdio_probe(). No work will be queued on sdio workqueue between it is destroyed and ath10k_core_destroy() is called. Based on the call_stack above, the reason is: Only ath10k_sdio_sleep_timer_handler(), ath10k_sdio_hif_tx_sg() and ath10k_sdio_irq_disable() will queue work on sdio workqueue. Sleep timer will be deleted before ath10k_core_destroy() in ath10k_hif_power_down(). ath10k_sdio_irq_disable() only be called in ath10k_hif_stop(). ath10k_core_unregister() will call ath10k_hif_power_down() to stop hif bus, so ath10k_sdio_hif_tx_sg() won't be called anymore. Tested-on: QCA6174 hw3.2 SDIO WLAN.RMH.4.4.1-00189
Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 5e3dd157d7e70f0e3cea3f2573ed69fb156a19d5 , < 27d5d217ae7ffb99dd623375a17a7d3418d9c755 (git)
Affected: 5e3dd157d7e70f0e3cea3f2573ed69fb156a19d5 , < 27fda36eedad9e4ec795dc481f307901d1885112 (git)
Affected: 5e3dd157d7e70f0e3cea3f2573ed69fb156a19d5 , < 6e5dbd1c04abf2c19b2282915e6fa48b6ccc6921 (git)
Affected: 5e3dd157d7e70f0e3cea3f2573ed69fb156a19d5 , < b35de9e01fc79c7baac666fb2dcb4ba7698a1d97 (git)
Affected: 5e3dd157d7e70f0e3cea3f2573ed69fb156a19d5 , < 543c0924d446b21f35701ca084d7feca09511220 (git)
Affected: 5e3dd157d7e70f0e3cea3f2573ed69fb156a19d5 , < 95c38953cb1ecf40399a676a1f85dfe2b5780a9a (git)
guessed Create a notification for this product.
Linux Linux Affected: 3.11
Unaffected: 0 , < 3.11 (semver)
Unaffected: 5.10.237 , ≤ 5.10.* (semver)
Unaffected: 5.15.181 , ≤ 5.15.* (semver)
Unaffected: 6.1.127 , ≤ 6.1.* (semver)
Unaffected: 6.6.70 , ≤ 6.6.* (semver)
Unaffected: 6.12.5 , ≤ 6.12.* (semver)
Unaffected: 6.13 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T20:50:35.314Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/ath/ath10k/sdio.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "27d5d217ae7ffb99dd623375a17a7d3418d9c755",
              "status": "affected",
              "version": "5e3dd157d7e70f0e3cea3f2573ed69fb156a19d5",
              "versionType": "git"
            },
            {
              "lessThan": "27fda36eedad9e4ec795dc481f307901d1885112",
              "status": "affected",
              "version": "5e3dd157d7e70f0e3cea3f2573ed69fb156a19d5",
              "versionType": "git"
            },
            {
              "lessThan": "6e5dbd1c04abf2c19b2282915e6fa48b6ccc6921",
              "status": "affected",
              "version": "5e3dd157d7e70f0e3cea3f2573ed69fb156a19d5",
              "versionType": "git"
            },
            {
              "lessThan": "b35de9e01fc79c7baac666fb2dcb4ba7698a1d97",
              "status": "affected",
              "version": "5e3dd157d7e70f0e3cea3f2573ed69fb156a19d5",
              "versionType": "git"
            },
            {
              "lessThan": "543c0924d446b21f35701ca084d7feca09511220",
              "status": "affected",
              "version": "5e3dd157d7e70f0e3cea3f2573ed69fb156a19d5",
              "versionType": "git"
            },
            {
              "lessThan": "95c38953cb1ecf40399a676a1f85dfe2b5780a9a",
              "status": "affected",
              "version": "5e3dd157d7e70f0e3cea3f2573ed69fb156a19d5",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/ath/ath10k/sdio.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.11"
            },
            {
              "lessThan": "3.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.237",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.181",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.127",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.70",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.237",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.181",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.127",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.70",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.5",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath10k: avoid NULL pointer error during sdio remove\n\nWhen running \u0027rmmod ath10k\u0027, ath10k_sdio_remove() will free sdio\nworkqueue by destroy_workqueue(). But if CONFIG_INIT_ON_FREE_DEFAULT_ON\nis set to yes, kernel panic will happen:\nCall trace:\n destroy_workqueue+0x1c/0x258\n ath10k_sdio_remove+0x84/0x94\n sdio_bus_remove+0x50/0x16c\n device_release_driver_internal+0x188/0x25c\n device_driver_detach+0x20/0x2c\n\nThis is because during \u0027rmmod ath10k\u0027, ath10k_sdio_remove() will call\nath10k_core_destroy() before destroy_workqueue(). wiphy_dev_release()\nwill finally be called in ath10k_core_destroy(). This function will free\nstruct cfg80211_registered_device *rdev and all its members, including\nwiphy, dev and the pointer of sdio workqueue. Then the pointer of sdio\nworkqueue will be set to NULL due to CONFIG_INIT_ON_FREE_DEFAULT_ON.\n\nAfter device release, destroy_workqueue() will use NULL pointer then the\nkernel panic happen.\n\nCall trace:\nath10k_sdio_remove\n  -\u003eath10k_core_unregister\n    \u2026\u2026\n    -\u003eath10k_core_stop\n      -\u003eath10k_hif_stop\n        -\u003eath10k_sdio_irq_disable\n    -\u003eath10k_hif_power_down\n      -\u003edel_timer_sync(\u0026ar_sdio-\u003esleep_timer)\n  -\u003eath10k_core_destroy\n    -\u003eath10k_mac_destroy\n      -\u003eieee80211_free_hw\n        -\u003ewiphy_free\n    \u2026\u2026\n          -\u003ewiphy_dev_release\n  -\u003edestroy_workqueue\n\nNeed to call destroy_workqueue() before ath10k_core_destroy(), free\nthe work queue buffer first and then free pointer of work queue by\nath10k_core_destroy(). This order matches the error path order in\nath10k_sdio_probe().\n\nNo work will be queued on sdio workqueue between it is destroyed and\nath10k_core_destroy() is called. Based on the call_stack above, the\nreason is:\nOnly ath10k_sdio_sleep_timer_handler(), ath10k_sdio_hif_tx_sg() and\nath10k_sdio_irq_disable() will queue work on sdio workqueue.\nSleep timer will be deleted before ath10k_core_destroy() in\nath10k_hif_power_down().\nath10k_sdio_irq_disable() only be called in ath10k_hif_stop().\nath10k_core_unregister() will call ath10k_hif_power_down() to stop hif\nbus, so ath10k_sdio_hif_tx_sg() won\u0027t be called anymore.\n\nTested-on: QCA6174 hw3.2 SDIO WLAN.RMH.4.4.1-00189"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T20:55:34.718Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/27d5d217ae7ffb99dd623375a17a7d3418d9c755"
        },
        {
          "url": "https://git.kernel.org/stable/c/27fda36eedad9e4ec795dc481f307901d1885112"
        },
        {
          "url": "https://git.kernel.org/stable/c/6e5dbd1c04abf2c19b2282915e6fa48b6ccc6921"
        },
        {
          "url": "https://git.kernel.org/stable/c/b35de9e01fc79c7baac666fb2dcb4ba7698a1d97"
        },
        {
          "url": "https://git.kernel.org/stable/c/543c0924d446b21f35701ca084d7feca09511220"
        },
        {
          "url": "https://git.kernel.org/stable/c/95c38953cb1ecf40399a676a1f85dfe2b5780a9a"
        }
      ],
      "title": "wifi: ath10k: avoid NULL pointer error during sdio remove",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-56599",
    "datePublished": "2024-12-27T14:51:05.866Z",
    "dateReserved": "2024-12-27T14:03:06.011Z",
    "dateUpdated": "2026-05-11T20:55:34.718Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-56599",
      "date": "2026-09-16",
      "epss": "0.00234",
      "percentile": "0.14492"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"6.12.5\", \"matchCriteriaId\": \"75E05E0A-C898-433A-8E50-6D9EC8646A64\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: ath10k: avoid NULL pointer error during sdio remove\\n\\nWhen running \u0027rmmod ath10k\u0027, ath10k_sdio_remove() will free sdio\\nworkqueue by destroy_workqueue(). But if CONFIG_INIT_ON_FREE_DEFAULT_ON\\nis set to yes, kernel panic will happen:\\nCall trace:\\n destroy_workqueue+0x1c/0x258\\n ath10k_sdio_remove+0x84/0x94\\n sdio_bus_remove+0x50/0x16c\\n device_release_driver_internal+0x188/0x25c\\n device_driver_detach+0x20/0x2c\\n\\nThis is because during \u0027rmmod ath10k\u0027, ath10k_sdio_remove() will call\\nath10k_core_destroy() before destroy_workqueue(). wiphy_dev_release()\\nwill finally be called in ath10k_core_destroy(). This function will free\\nstruct cfg80211_registered_device *rdev and all its members, including\\nwiphy, dev and the pointer of sdio workqueue. Then the pointer of sdio\\nworkqueue will be set to NULL due to CONFIG_INIT_ON_FREE_DEFAULT_ON.\\n\\nAfter device release, destroy_workqueue() will use NULL pointer then the\\nkernel panic happen.\\n\\nCall trace:\\nath10k_sdio_remove\\n  -\u003eath10k_core_unregister\\n    \\u2026\\u2026\\n    -\u003eath10k_core_stop\\n      -\u003eath10k_hif_stop\\n        -\u003eath10k_sdio_irq_disable\\n    -\u003eath10k_hif_power_down\\n      -\u003edel_timer_sync(\u0026ar_sdio-\u003esleep_timer)\\n  -\u003eath10k_core_destroy\\n    -\u003eath10k_mac_destroy\\n      -\u003eieee80211_free_hw\\n        -\u003ewiphy_free\\n    \\u2026\\u2026\\n          -\u003ewiphy_dev_release\\n  -\u003edestroy_workqueue\\n\\nNeed to call destroy_workqueue() before ath10k_core_destroy(), free\\nthe work queue buffer first and then free pointer of work queue by\\nath10k_core_destroy(). This order matches the error path order in\\nath10k_sdio_probe().\\n\\nNo work will be queued on sdio workqueue between it is destroyed and\\nath10k_core_destroy() is called. Based on the call_stack above, the\\nreason is:\\nOnly ath10k_sdio_sleep_timer_handler(), ath10k_sdio_hif_tx_sg() and\\nath10k_sdio_irq_disable() will queue work on sdio workqueue.\\nSleep timer will be deleted before ath10k_core_destroy() in\\nath10k_hif_power_down().\\nath10k_sdio_irq_disable() only be called in ath10k_hif_stop().\\nath10k_core_unregister() will call ath10k_hif_power_down() to stop hif\\nbus, so ath10k_sdio_hif_tx_sg() won\u0027t be called anymore.\\n\\nTested-on: QCA6174 hw3.2 SDIO WLAN.RMH.4.4.1-00189\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: wifi: ath10k: evitar error de puntero NULL durante la eliminaci\\u00f3n de sdio Al ejecutar \u0027rmmod ath10k\u0027, ath10k_sdio_remove() liberar\\u00e1 la cola de trabajo de sdio mediante destroy_workqueue(). Pero si CONFIG_INIT_ON_FREE_DEFAULT_ON est\\u00e1 configurado en s\\u00ed, se producir\\u00e1 un p\\u00e1nico del kernel: Rastreo de llamada: destroy_workqueue+0x1c/0x258 ath10k_sdio_remove+0x84/0x94 sdio_bus_remove+0x50/0x16c device_release_driver_internal+0x188/0x25c device_driver_detach+0x20/0x2c Esto se debe a que durante \u0027rmmod ath10k\u0027, ath10k_sdio_remove() llamar\\u00e1 a ath10k_core_destroy() antes de destroy_workqueue(). wiphy_dev_release() finalmente se llamar\\u00e1 en ath10k_core_destroy(). Esta funci\\u00f3n liberar\\u00e1 la estructura cfg80211_registered_device *rdev y todos sus miembros, incluidos wiphy, dev y el puntero de sdio workqueue. Luego, el puntero de sdio workqueue se establecer\\u00e1 en NULL debido a CONFIG_INIT_ON_FREE_DEFAULT_ON. Despu\\u00e9s de liberar el dispositivo, destroy_workqueue() usar\\u00e1 el puntero NULL y luego se producir\\u00e1 el p\\u00e1nico del kernel. Rastreo de llamadas: ath10k_sdio_remove -\u0026gt;ath10k_core_unregister \\u2026\\u2026 -\u0026gt;ath10k_core_stop -\u0026gt;ath10k_hif_stop -\u0026gt;ath10k_sdio_irq_disable -\u0026gt;ath10k_hif_power_down -\u0026gt;del_timer_sync(\u0026amp;ar_sdio-\u0026gt;sleep_timer) -\u0026gt;ath10k_core_destroy -\u0026gt;ath10k_mac_destroy -\u0026gt;ieee80211_free_hw -\u0026gt;wiphy_free \\u2026\\u2026 -\u0026gt;wiphy_dev_release -\u0026gt;destroy_workqueue Es necesario llamar a destroy_workqueue() antes de ath10k_core_destroy(), primero liberar el b\\u00fafer de la cola de trabajo y luego liberar el puntero de la cola de trabajo mediante ath10k_core_destroy(). Este orden coincide con el orden de la ruta de error en ath10k_sdio_probe(). No se pondr\\u00e1 en cola ning\\u00fan trabajo en la cola de trabajo de sdio entre su destrucci\\u00f3n y la llamada a ath10k_core_destroy(). Seg\\u00fan la pila de llamadas anterior, el motivo es el siguiente: solo ath10k_sdio_sleep_timer_handler(), ath10k_sdio_hif_tx_sg() y ath10k_sdio_irq_disable() pondr\\u00e1n en cola el trabajo en la cola de trabajo de sdio. El temporizador de suspensi\\u00f3n se eliminar\\u00e1 antes de ath10k_core_destroy() en ath10k_hif_power_down(). ath10k_sdio_irq_disable() solo se llamar\\u00e1 en ath10k_hif_stop(). ath10k_core_unregister() llamar\\u00e1 a ath10k_hif_power_down() para detener el bus hif, por lo que ya no se llamar\\u00e1 ath10k_sdio_hif_tx_sg(). Probado en: QCA6174 hw3.2 SDIO WLAN.RMH.4.4.1-00189\"}]",
      "id": "CVE-2024-56599",
      "lastModified": "2025-01-09T16:16:22.167",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 3.6}]}",
      "published": "2024-12-27T15:15:19.307",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/543c0924d446b21f35701ca084d7feca09511220\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/95c38953cb1ecf40399a676a1f85dfe2b5780a9a\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/b35de9e01fc79c7baac666fb2dcb4ba7698a1d97\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-476\"}]}]"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-18T01:33:21.000Z",
      "cve": "CVE-2024-56599",
      "id": "msrc_CVE-2024-56599",
      "initial_release_date": "2024-12-02T00:00:00.000Z",
      "product_status:fixed": "4",
      "product_status:known_affected": "4",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "wifi: ath10k: avoid NULL pointer error during sdio remove",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-56599.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-56599\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-12-27T15:15:19.307\",\"lastModified\":\"2026-06-17T08:12:30.777\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: ath10k: avoid NULL pointer error during sdio remove\\n\\nWhen running \u0027rmmod ath10k\u0027, ath10k_sdio_remove() will free sdio\\nworkqueue by destroy_workqueue(). But if CONFIG_INIT_ON_FREE_DEFAULT_ON\\nis set to yes, kernel panic will happen:\\nCall trace:\\n destroy_workqueue+0x1c/0x258\\n ath10k_sdio_remove+0x84/0x94\\n sdio_bus_remove+0x50/0x16c\\n device_release_driver_internal+0x188/0x25c\\n device_driver_detach+0x20/0x2c\\n\\nThis is because during \u0027rmmod ath10k\u0027, ath10k_sdio_remove() will call\\nath10k_core_destroy() before destroy_workqueue(). wiphy_dev_release()\\nwill finally be called in ath10k_core_destroy(). This function will free\\nstruct cfg80211_registered_device *rdev and all its members, including\\nwiphy, dev and the pointer of sdio workqueue. Then the pointer of sdio\\nworkqueue will be set to NULL due to CONFIG_INIT_ON_FREE_DEFAULT_ON.\\n\\nAfter device release, destroy_workqueue() will use NULL pointer then the\\nkernel panic happen.\\n\\nCall trace:\\nath10k_sdio_remove\\n  -\u003eath10k_core_unregister\\n    \u2026\u2026\\n    -\u003eath10k_core_stop\\n      -\u003eath10k_hif_stop\\n        -\u003eath10k_sdio_irq_disable\\n    -\u003eath10k_hif_power_down\\n      -\u003edel_timer_sync(\u0026ar_sdio-\u003esleep_timer)\\n  -\u003eath10k_core_destroy\\n    -\u003eath10k_mac_destroy\\n      -\u003eieee80211_free_hw\\n        -\u003ewiphy_free\\n    \u2026\u2026\\n          -\u003ewiphy_dev_release\\n  -\u003edestroy_workqueue\\n\\nNeed to call destroy_workqueue() before ath10k_core_destroy(), free\\nthe work queue buffer first and then free pointer of work queue by\\nath10k_core_destroy(). This order matches the error path order in\\nath10k_sdio_probe().\\n\\nNo work will be queued on sdio workqueue between it is destroyed and\\nath10k_core_destroy() is called. Based on the call_stack above, the\\nreason is:\\nOnly ath10k_sdio_sleep_timer_handler(), ath10k_sdio_hif_tx_sg() and\\nath10k_sdio_irq_disable() will queue work on sdio workqueue.\\nSleep timer will be deleted before ath10k_core_destroy() in\\nath10k_hif_power_down().\\nath10k_sdio_irq_disable() only be called in ath10k_hif_stop().\\nath10k_core_unregister() will call ath10k_hif_power_down() to stop hif\\nbus, so ath10k_sdio_hif_tx_sg() won\u0027t be called anymore.\\n\\nTested-on: QCA6174 hw3.2 SDIO WLAN.RMH.4.4.1-00189\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: wifi: ath10k: evitar error de puntero NULL durante la eliminaci\u00f3n de sdio Al ejecutar \u0027rmmod ath10k\u0027, ath10k_sdio_remove() liberar\u00e1 la cola de trabajo de sdio mediante destroy_workqueue(). Pero si CONFIG_INIT_ON_FREE_DEFAULT_ON est\u00e1 configurado en s\u00ed, se producir\u00e1 un p\u00e1nico del kernel: Rastreo de llamada: destroy_workqueue+0x1c/0x258 ath10k_sdio_remove+0x84/0x94 sdio_bus_remove+0x50/0x16c device_release_driver_internal+0x188/0x25c device_driver_detach+0x20/0x2c Esto se debe a que durante \u0027rmmod ath10k\u0027, ath10k_sdio_remove() llamar\u00e1 a ath10k_core_destroy() antes de destroy_workqueue(). wiphy_dev_release() finalmente se llamar\u00e1 en ath10k_core_destroy(). Esta funci\u00f3n liberar\u00e1 la estructura cfg80211_registered_device *rdev y todos sus miembros, incluidos wiphy, dev y el puntero de sdio workqueue. Luego, el puntero de sdio workqueue se establecer\u00e1 en NULL debido a CONFIG_INIT_ON_FREE_DEFAULT_ON. Despu\u00e9s de liberar el dispositivo, destroy_workqueue() usar\u00e1 el puntero NULL y luego se producir\u00e1 el p\u00e1nico del kernel. Rastreo de llamadas: ath10k_sdio_remove -\u0026gt;ath10k_core_unregister \u2026\u2026 -\u0026gt;ath10k_core_stop -\u0026gt;ath10k_hif_stop -\u0026gt;ath10k_sdio_irq_disable -\u0026gt;ath10k_hif_power_down -\u0026gt;del_timer_sync(\u0026amp;ar_sdio-\u0026gt;sleep_timer) -\u0026gt;ath10k_core_destroy -\u0026gt;ath10k_mac_destroy -\u0026gt;ieee80211_free_hw -\u0026gt;wiphy_free \u2026\u2026 -\u0026gt;wiphy_dev_release -\u0026gt;destroy_workqueue Es necesario llamar a destroy_workqueue() antes de ath10k_core_destroy(), primero liberar el b\u00fafer de la cola de trabajo y luego liberar el puntero de la cola de trabajo mediante ath10k_core_destroy(). Este orden coincide con el orden de la ruta de error en ath10k_sdio_probe(). No se pondr\u00e1 en cola ning\u00fan trabajo en la cola de trabajo de sdio entre su destrucci\u00f3n y la llamada a ath10k_core_destroy(). Seg\u00fan la pila de llamadas anterior, el motivo es el siguiente: solo ath10k_sdio_sleep_timer_handler(), ath10k_sdio_hif_tx_sg() y ath10k_sdio_irq_disable() pondr\u00e1n en cola el trabajo en la cola de trabajo de sdio. El temporizador de suspensi\u00f3n se eliminar\u00e1 antes de ath10k_core_destroy() en ath10k_hif_power_down(). ath10k_sdio_irq_disable() solo se llamar\u00e1 en ath10k_hif_stop(). ath10k_core_unregister() llamar\u00e1 a ath10k_hif_power_down() para detener el bus hif, por lo que ya no se llamar\u00e1 ath10k_sdio_hif_tx_sg(). Probado en: QCA6174 hw3.2 SDIO WLAN.RMH.4.4.1-00189\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/wireless/ath/ath10k/sdio.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5e3dd157d7e70f0e3cea3f2573ed69fb156a19d5\",\"lessThan\":\"27d5d217ae7ffb99dd623375a17a7d3418d9c755\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5e3dd157d7e70f0e3cea3f2573ed69fb156a19d5\",\"lessThan\":\"27fda36eedad9e4ec795dc481f307901d1885112\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5e3dd157d7e70f0e3cea3f2573ed69fb156a19d5\",\"lessThan\":\"6e5dbd1c04abf2c19b2282915e6fa48b6ccc6921\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5e3dd157d7e70f0e3cea3f2573ed69fb156a19d5\",\"lessThan\":\"b35de9e01fc79c7baac666fb2dcb4ba7698a1d97\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5e3dd157d7e70f0e3cea3f2573ed69fb156a19d5\",\"lessThan\":\"543c0924d446b21f35701ca084d7feca09511220\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5e3dd157d7e70f0e3cea3f2573ed69fb156a19d5\",\"lessThan\":\"95c38953cb1ecf40399a676a1f85dfe2b5780a9a\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/wireless/ath/ath10k/sdio.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3.11\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"3.11\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.237\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.181\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.127\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.70\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.5\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.13\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"6.12.5\",\"matchCriteriaId\":\"75E05E0A-C898-433A-8E50-6D9EC8646A64\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/27d5d217ae7ffb99dd623375a17a7d3418d9c755\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/27fda36eedad9e4ec795dc481f307901d1885112\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/543c0924d446b21f35701ca084d7feca09511220\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6e5dbd1c04abf2c19b2282915e6fa48b6ccc6921\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/95c38953cb1ecf40399a676a1f85dfe2b5780a9a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b35de9e01fc79c7baac666fb2dcb4ba7698a1d97\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2025-11-21T13:58:29+00:00",
      "cve": "CVE-2024-56599",
      "id": "CVE-2024-56599",
      "initial_release_date": "2024-12-27T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: wifi: ath10k: avoid NULL pointer error during sdio remove",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-56599.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-11T16:41:32Z",
      "cve": "CVE-2024-56599",
      "id": "CVE-2024-56599",
      "initial_release_date": "2025-09-22T23:31:16Z",
      "product_status:known_affected": "753",
      "product_status:known_not_affected": "102",
      "product_status:recommended": "384",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-56599",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-56599.json",
      "version": "26"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.