GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-56609 (GCVE-0-2024-56609)

Vulnerability from cvelistv5 – Published: 2024-12-27 14:51 – Updated: 2026-05-11 20:55
VLAI
Title
wifi: rtw88: use ieee80211_purge_tx_queue() to purge TX skb
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: use ieee80211_purge_tx_queue() to purge TX skb When removing kernel modules by: rmmod rtw88_8723cs rtw88_8703b rtw88_8723x rtw88_sdio rtw88_core Driver uses skb_queue_purge() to purge TX skb, but not report tx status causing "Have pending ack frames!" warning. Use ieee80211_purge_tx_queue() to correct this. Since ieee80211_purge_tx_queue() doesn't take locks, to prevent racing between TX work and purge TX queue, flush and destroy TX work in advance. wlan0: deauthenticating from aa:f5:fd:60:4c:a8 by local choice (Reason: 3=DEAUTH_LEAVING) ------------[ cut here ]------------ Have pending ack frames! WARNING: CPU: 3 PID: 9232 at net/mac80211/main.c:1691 ieee80211_free_ack_frame+0x5c/0x90 [mac80211] CPU: 3 PID: 9232 Comm: rmmod Tainted: G C 6.10.1-200.fc40.aarch64 #1 Hardware name: pine64 Pine64 PinePhone Braveheart (1.1)/Pine64 PinePhone Braveheart (1.1), BIOS 2024.01 01/01/2024 pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : ieee80211_free_ack_frame+0x5c/0x90 [mac80211] lr : ieee80211_free_ack_frame+0x5c/0x90 [mac80211] sp : ffff80008c1b37b0 x29: ffff80008c1b37b0 x28: ffff000003be8000 x27: 0000000000000000 x26: 0000000000000000 x25: ffff000003dc14b8 x24: ffff80008c1b37d0 x23: ffff000000ff9f80 x22: 0000000000000000 x21: 000000007fffffff x20: ffff80007c7e93d8 x19: ffff00006e66f400 x18: 0000000000000000 x17: ffff7ffffd2b3000 x16: ffff800083fc0000 x15: 0000000000000000 x14: 0000000000000000 x13: 2173656d61726620 x12: 6b636120676e6964 x11: 0000000000000000 x10: 000000000000005d x9 : ffff8000802af2b0 x8 : ffff80008c1b3430 x7 : 0000000000000001 x6 : 0000000000000001 x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000 x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff000003be8000 Call trace: ieee80211_free_ack_frame+0x5c/0x90 [mac80211] idr_for_each+0x74/0x110 ieee80211_free_hw+0x44/0xe8 [mac80211] rtw_sdio_remove+0x9c/0xc0 [rtw88_sdio] sdio_bus_remove+0x44/0x180 device_remove+0x54/0x90 device_release_driver_internal+0x1d4/0x238 driver_detach+0x54/0xc0 bus_remove_driver+0x78/0x108 driver_unregister+0x38/0x78 sdio_unregister_driver+0x2c/0x40 rtw_8723cs_driver_exit+0x18/0x1000 [rtw88_8723cs] __do_sys_delete_module.isra.0+0x190/0x338 __arm64_sys_delete_module+0x1c/0x30 invoke_syscall+0x74/0x100 el0_svc_common.constprop.0+0x48/0xf0 do_el0_svc+0x24/0x38 el0_svc+0x3c/0x158 el0t_64_sync_handler+0x120/0x138 el0t_64_sync+0x194/0x198 ---[ end trace 0000000000000000 ]---
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: e3037485c68ec1a299ff41160d8fedbd4abc29b9 , < 4e8ce3978d704cb28678355d294e10a008b6230a (git)
Affected: e3037485c68ec1a299ff41160d8fedbd4abc29b9 , < 3d94c4b21966b49c3e26ceeefacaa11ff7ee6d68 (git)
Affected: e3037485c68ec1a299ff41160d8fedbd4abc29b9 , < 9bca6528f20325d30c22236b23116f161d418f6d (git)
Affected: e3037485c68ec1a299ff41160d8fedbd4abc29b9 , < 3e5e4a801aaf4283390cc34959c6c48f910ca5ea (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.2
Unaffected: 0 , < 5.2 (semver)
Unaffected: 6.1.136 , ≤ 6.1.* (semver)
Unaffected: 6.6.70 , ≤ 6.6.* (semver)
Unaffected: 6.12.5 , ≤ 6.12.* (semver)
Unaffected: 6.13 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T19:32:28.553Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/realtek/rtw88/sdio.c",
            "drivers/net/wireless/realtek/rtw88/usb.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4e8ce3978d704cb28678355d294e10a008b6230a",
              "status": "affected",
              "version": "e3037485c68ec1a299ff41160d8fedbd4abc29b9",
              "versionType": "git"
            },
            {
              "lessThan": "3d94c4b21966b49c3e26ceeefacaa11ff7ee6d68",
              "status": "affected",
              "version": "e3037485c68ec1a299ff41160d8fedbd4abc29b9",
              "versionType": "git"
            },
            {
              "lessThan": "9bca6528f20325d30c22236b23116f161d418f6d",
              "status": "affected",
              "version": "e3037485c68ec1a299ff41160d8fedbd4abc29b9",
              "versionType": "git"
            },
            {
              "lessThan": "3e5e4a801aaf4283390cc34959c6c48f910ca5ea",
              "status": "affected",
              "version": "e3037485c68ec1a299ff41160d8fedbd4abc29b9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/realtek/rtw88/sdio.c",
            "drivers/net/wireless/realtek/rtw88/usb.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.2"
            },
            {
              "lessThan": "5.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.136",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.70",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.136",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.70",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.5",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtw88: use ieee80211_purge_tx_queue() to purge TX skb\n\nWhen removing kernel modules by:\n   rmmod rtw88_8723cs rtw88_8703b rtw88_8723x rtw88_sdio rtw88_core\n\nDriver uses skb_queue_purge() to purge TX skb, but not report tx status\ncausing \"Have pending ack frames!\" warning. Use ieee80211_purge_tx_queue()\nto correct this.\n\nSince ieee80211_purge_tx_queue() doesn\u0027t take locks, to prevent racing\nbetween TX work and purge TX queue, flush and destroy TX work in advance.\n\n   wlan0: deauthenticating from aa:f5:fd:60:4c:a8 by local\n     choice (Reason: 3=DEAUTH_LEAVING)\n   ------------[ cut here ]------------\n   Have pending ack frames!\n   WARNING: CPU: 3 PID: 9232 at net/mac80211/main.c:1691\n       ieee80211_free_ack_frame+0x5c/0x90 [mac80211]\n   CPU: 3 PID: 9232 Comm: rmmod Tainted: G         C\n       6.10.1-200.fc40.aarch64 #1\n   Hardware name: pine64 Pine64 PinePhone Braveheart\n      (1.1)/Pine64 PinePhone Braveheart (1.1), BIOS 2024.01 01/01/2024\n   pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n   pc : ieee80211_free_ack_frame+0x5c/0x90 [mac80211]\n   lr : ieee80211_free_ack_frame+0x5c/0x90 [mac80211]\n   sp : ffff80008c1b37b0\n   x29: ffff80008c1b37b0 x28: ffff000003be8000 x27: 0000000000000000\n   x26: 0000000000000000 x25: ffff000003dc14b8 x24: ffff80008c1b37d0\n   x23: ffff000000ff9f80 x22: 0000000000000000 x21: 000000007fffffff\n   x20: ffff80007c7e93d8 x19: ffff00006e66f400 x18: 0000000000000000\n   x17: ffff7ffffd2b3000 x16: ffff800083fc0000 x15: 0000000000000000\n   x14: 0000000000000000 x13: 2173656d61726620 x12: 6b636120676e6964\n   x11: 0000000000000000 x10: 000000000000005d x9 : ffff8000802af2b0\n   x8 : ffff80008c1b3430 x7 : 0000000000000001 x6 : 0000000000000001\n   x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000\n   x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff000003be8000\n   Call trace:\n    ieee80211_free_ack_frame+0x5c/0x90 [mac80211]\n    idr_for_each+0x74/0x110\n    ieee80211_free_hw+0x44/0xe8 [mac80211]\n    rtw_sdio_remove+0x9c/0xc0 [rtw88_sdio]\n    sdio_bus_remove+0x44/0x180\n    device_remove+0x54/0x90\n    device_release_driver_internal+0x1d4/0x238\n    driver_detach+0x54/0xc0\n    bus_remove_driver+0x78/0x108\n    driver_unregister+0x38/0x78\n    sdio_unregister_driver+0x2c/0x40\n    rtw_8723cs_driver_exit+0x18/0x1000 [rtw88_8723cs]\n    __do_sys_delete_module.isra.0+0x190/0x338\n    __arm64_sys_delete_module+0x1c/0x30\n    invoke_syscall+0x74/0x100\n    el0_svc_common.constprop.0+0x48/0xf0\n    do_el0_svc+0x24/0x38\n    el0_svc+0x3c/0x158\n    el0t_64_sync_handler+0x120/0x138\n    el0t_64_sync+0x194/0x198\n   ---[ end trace 0000000000000000 ]---"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T20:55:46.470Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4e8ce3978d704cb28678355d294e10a008b6230a"
        },
        {
          "url": "https://git.kernel.org/stable/c/3d94c4b21966b49c3e26ceeefacaa11ff7ee6d68"
        },
        {
          "url": "https://git.kernel.org/stable/c/9bca6528f20325d30c22236b23116f161d418f6d"
        },
        {
          "url": "https://git.kernel.org/stable/c/3e5e4a801aaf4283390cc34959c6c48f910ca5ea"
        }
      ],
      "title": "wifi: rtw88: use ieee80211_purge_tx_queue() to purge TX skb",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-56609",
    "datePublished": "2024-12-27T14:51:14.155Z",
    "dateReserved": "2024-12-27T14:03:06.013Z",
    "dateUpdated": "2026-05-11T20:55:46.470Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-56609",
      "date": "2026-09-16",
      "epss": "0.00228",
      "percentile": "0.13677"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: rtw88: use ieee80211_purge_tx_queue() to purge TX skb\\n\\nWhen removing kernel modules by:\\n   rmmod rtw88_8723cs rtw88_8703b rtw88_8723x rtw88_sdio rtw88_core\\n\\nDriver uses skb_queue_purge() to purge TX skb, but not report tx status\\ncausing \\\"Have pending ack frames!\\\" warning. Use ieee80211_purge_tx_queue()\\nto correct this.\\n\\nSince ieee80211_purge_tx_queue() doesn\u0027t take locks, to prevent racing\\nbetween TX work and purge TX queue, flush and destroy TX work in advance.\\n\\n   wlan0: deauthenticating from aa:f5:fd:60:4c:a8 by local\\n     choice (Reason: 3=DEAUTH_LEAVING)\\n   ------------[ cut here ]------------\\n   Have pending ack frames!\\n   WARNING: CPU: 3 PID: 9232 at net/mac80211/main.c:1691\\n       ieee80211_free_ack_frame+0x5c/0x90 [mac80211]\\n   CPU: 3 PID: 9232 Comm: rmmod Tainted: G         C\\n       6.10.1-200.fc40.aarch64 #1\\n   Hardware name: pine64 Pine64 PinePhone Braveheart\\n      (1.1)/Pine64 PinePhone Braveheart (1.1), BIOS 2024.01 01/01/2024\\n   pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\\n   pc : ieee80211_free_ack_frame+0x5c/0x90 [mac80211]\\n   lr : ieee80211_free_ack_frame+0x5c/0x90 [mac80211]\\n   sp : ffff80008c1b37b0\\n   x29: ffff80008c1b37b0 x28: ffff000003be8000 x27: 0000000000000000\\n   x26: 0000000000000000 x25: ffff000003dc14b8 x24: ffff80008c1b37d0\\n   x23: ffff000000ff9f80 x22: 0000000000000000 x21: 000000007fffffff\\n   x20: ffff80007c7e93d8 x19: ffff00006e66f400 x18: 0000000000000000\\n   x17: ffff7ffffd2b3000 x16: ffff800083fc0000 x15: 0000000000000000\\n   x14: 0000000000000000 x13: 2173656d61726620 x12: 6b636120676e6964\\n   x11: 0000000000000000 x10: 000000000000005d x9 : ffff8000802af2b0\\n   x8 : ffff80008c1b3430 x7 : 0000000000000001 x6 : 0000000000000001\\n   x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000\\n   x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff000003be8000\\n   Call trace:\\n    ieee80211_free_ack_frame+0x5c/0x90 [mac80211]\\n    idr_for_each+0x74/0x110\\n    ieee80211_free_hw+0x44/0xe8 [mac80211]\\n    rtw_sdio_remove+0x9c/0xc0 [rtw88_sdio]\\n    sdio_bus_remove+0x44/0x180\\n    device_remove+0x54/0x90\\n    device_release_driver_internal+0x1d4/0x238\\n    driver_detach+0x54/0xc0\\n    bus_remove_driver+0x78/0x108\\n    driver_unregister+0x38/0x78\\n    sdio_unregister_driver+0x2c/0x40\\n    rtw_8723cs_driver_exit+0x18/0x1000 [rtw88_8723cs]\\n    __do_sys_delete_module.isra.0+0x190/0x338\\n    __arm64_sys_delete_module+0x1c/0x30\\n    invoke_syscall+0x74/0x100\\n    el0_svc_common.constprop.0+0x48/0xf0\\n    do_el0_svc+0x24/0x38\\n    el0_svc+0x3c/0x158\\n    el0t_64_sync_handler+0x120/0x138\\n    el0t_64_sync+0x194/0x198\\n   ---[ end trace 0000000000000000 ]---\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: wifi: rtw88: use ieee80211_purge_tx_queue() para purgar TX skb Al eliminar m\\u00f3dulos del kernel mediante: rmmod rtw88_8723cs rtw88_8703b rtw88_8723x rtw88_sdio rtw88_core El controlador usa skb_queue_purge() para purgar TX skb, pero no informa el estado de la tx, lo que provoca la advertencia \\\"\\u00a1Tiene marcos de reconocimiento pendientes!\\\". Use ieee80211_purge_tx_queue() para corregir esto. Dado que ieee80211_purge_tx_queue() no toma bloqueos, para evitar ejecuci\\u00f3ns entre el trabajo de TX y la cola de purga de TX, vac\\u00ede y destruya el trabajo de TX con anticipaci\\u00f3n. wlan0: desautenticando desde aa:f5:fd:60:4c:a8 por elecci\\u00f3n local (Raz\\u00f3n: 3=DEAUTH_LEAVING) ------------[ cortar aqu\\u00ed ]------------ \\u00a1Hay marcos de reconocimiento pendientes! ADVERTENCIA: CPU: 3 PID: 9232 en net/mac80211/main.c:1691 ieee80211_free_ack_frame+0x5c/0x90 [mac80211] CPU: 3 PID: 9232 Comm: rmmod Contaminado: GC 6.10.1-200.fc40.aarch64 #1 Nombre del hardware: pine64 Pine64 PinePhone Braveheart (1.1)/Pine64 PinePhone Braveheart (1.1), BIOS 2024.01 01/01/2024 pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : ieee80211_free_ack_frame+0x5c/0x90 [mac80211] lr : ieee80211_free_ack_frame+0x5c/0x90 [mac80211] sp : ffff80008c1b37b0 x29: ffff80008c1b37b0 x28: ffff000003be8000 x27: 0000000000000000 x26: 0000000000000000 x25: ffff000003dc14b8 x24: ffff80008c1b37d0 x23: ffff000000ff9f80 x22: 0000000000000000 x21: 000000007fffffff x20: ffff80007c7e93d8 x19: ffff00006e66f400 x18: 0000000000000000 x17: ffff7ffffd2b3000 x16: ffff800083fc0000 x15: 0000000000000000 x14: 0000000000000000 x13: 2173656d61726620 x12: 6b636120676e6964 x11: 000000000000000 x10: 000000000000005d x9: ffff8000802af2b0 x8: ffff80008c1b3430 x7: 00000000000000001 x6 : 0000000000000001 x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000 x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff000003be8000 Rastreo de llamadas: ieee80211_free_ack_frame+0x5c/0x90 [mac80211] idr_for_each+0x74/0x110 ieee80211_free_hw+0x44/0xe8 [mac80211] rtw_sdio_remove+0x9c/0xc0 [rtw88_sdio] sdio_bus_remove+0x44/0x180 device_remove+0x54/0x90 device_release_driver_internal+0x1d4/0x238 driver_detach+0x54/0xc0 bus_remove_driver+0x78/0x108 driver_unregister+0x38/0x78 sdio_unregister_driver+0x2c/0x40 rtw_8723cs_driver_exit+0x18/0x1000 [rtw88_8723cs] __do_sys_delete_module.isra.0+0x190/0x338 __arm64_sys_delete_module+0x1c/0x30 invocar_llamada_al_sistema+0x74/0x100 el0_svc_common.constprop.0+0x48/0xf0 do_el0_svc+0x24/0x38 el0_svc+0x3c/0x158 el0t_64_sync_handler+0x120/0x138 el0t_64_sync+0x194/0x198 ---[ fin de seguimiento 0000000000000000 ]---\"}]",
      "id": "CVE-2024-56609",
      "lastModified": "2025-01-09T16:16:22.443",
      "published": "2024-12-27T15:15:20.387",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/3d94c4b21966b49c3e26ceeefacaa11ff7ee6d68\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/3e5e4a801aaf4283390cc34959c6c48f910ca5ea\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/9bca6528f20325d30c22236b23116f161d418f6d\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-56609\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-12-27T15:15:20.387\",\"lastModified\":\"2026-06-17T08:12:32.420\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: rtw88: use ieee80211_purge_tx_queue() to purge TX skb\\n\\nWhen removing kernel modules by:\\n   rmmod rtw88_8723cs rtw88_8703b rtw88_8723x rtw88_sdio rtw88_core\\n\\nDriver uses skb_queue_purge() to purge TX skb, but not report tx status\\ncausing \\\"Have pending ack frames!\\\" warning. Use ieee80211_purge_tx_queue()\\nto correct this.\\n\\nSince ieee80211_purge_tx_queue() doesn\u0027t take locks, to prevent racing\\nbetween TX work and purge TX queue, flush and destroy TX work in advance.\\n\\n   wlan0: deauthenticating from aa:f5:fd:60:4c:a8 by local\\n     choice (Reason: 3=DEAUTH_LEAVING)\\n   ------------[ cut here ]------------\\n   Have pending ack frames!\\n   WARNING: CPU: 3 PID: 9232 at net/mac80211/main.c:1691\\n       ieee80211_free_ack_frame+0x5c/0x90 [mac80211]\\n   CPU: 3 PID: 9232 Comm: rmmod Tainted: G         C\\n       6.10.1-200.fc40.aarch64 #1\\n   Hardware name: pine64 Pine64 PinePhone Braveheart\\n      (1.1)/Pine64 PinePhone Braveheart (1.1), BIOS 2024.01 01/01/2024\\n   pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\\n   pc : ieee80211_free_ack_frame+0x5c/0x90 [mac80211]\\n   lr : ieee80211_free_ack_frame+0x5c/0x90 [mac80211]\\n   sp : ffff80008c1b37b0\\n   x29: ffff80008c1b37b0 x28: ffff000003be8000 x27: 0000000000000000\\n   x26: 0000000000000000 x25: ffff000003dc14b8 x24: ffff80008c1b37d0\\n   x23: ffff000000ff9f80 x22: 0000000000000000 x21: 000000007fffffff\\n   x20: ffff80007c7e93d8 x19: ffff00006e66f400 x18: 0000000000000000\\n   x17: ffff7ffffd2b3000 x16: ffff800083fc0000 x15: 0000000000000000\\n   x14: 0000000000000000 x13: 2173656d61726620 x12: 6b636120676e6964\\n   x11: 0000000000000000 x10: 000000000000005d x9 : ffff8000802af2b0\\n   x8 : ffff80008c1b3430 x7 : 0000000000000001 x6 : 0000000000000001\\n   x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000\\n   x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff000003be8000\\n   Call trace:\\n    ieee80211_free_ack_frame+0x5c/0x90 [mac80211]\\n    idr_for_each+0x74/0x110\\n    ieee80211_free_hw+0x44/0xe8 [mac80211]\\n    rtw_sdio_remove+0x9c/0xc0 [rtw88_sdio]\\n    sdio_bus_remove+0x44/0x180\\n    device_remove+0x54/0x90\\n    device_release_driver_internal+0x1d4/0x238\\n    driver_detach+0x54/0xc0\\n    bus_remove_driver+0x78/0x108\\n    driver_unregister+0x38/0x78\\n    sdio_unregister_driver+0x2c/0x40\\n    rtw_8723cs_driver_exit+0x18/0x1000 [rtw88_8723cs]\\n    __do_sys_delete_module.isra.0+0x190/0x338\\n    __arm64_sys_delete_module+0x1c/0x30\\n    invoke_syscall+0x74/0x100\\n    el0_svc_common.constprop.0+0x48/0xf0\\n    do_el0_svc+0x24/0x38\\n    el0_svc+0x3c/0x158\\n    el0t_64_sync_handler+0x120/0x138\\n    el0t_64_sync+0x194/0x198\\n   ---[ end trace 0000000000000000 ]---\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: wifi: rtw88: use ieee80211_purge_tx_queue() para purgar TX skb Al eliminar m\u00f3dulos del kernel mediante: rmmod rtw88_8723cs rtw88_8703b rtw88_8723x rtw88_sdio rtw88_core El controlador usa skb_queue_purge() para purgar TX skb, pero no informa el estado de la tx, lo que provoca la advertencia \\\"\u00a1Tiene marcos de reconocimiento pendientes!\\\". Use ieee80211_purge_tx_queue() para corregir esto. Dado que ieee80211_purge_tx_queue() no toma bloqueos, para evitar ejecuci\u00f3ns entre el trabajo de TX y la cola de purga de TX, vac\u00ede y destruya el trabajo de TX con anticipaci\u00f3n. wlan0: desautenticando desde aa:f5:fd:60:4c:a8 por elecci\u00f3n local (Raz\u00f3n: 3=DEAUTH_LEAVING) ------------[ cortar aqu\u00ed ]------------ \u00a1Hay marcos de reconocimiento pendientes! ADVERTENCIA: CPU: 3 PID: 9232 en net/mac80211/main.c:1691 ieee80211_free_ack_frame+0x5c/0x90 [mac80211] CPU: 3 PID: 9232 Comm: rmmod Contaminado: GC 6.10.1-200.fc40.aarch64 #1 Nombre del hardware: pine64 Pine64 PinePhone Braveheart (1.1)/Pine64 PinePhone Braveheart (1.1), BIOS 2024.01 01/01/2024 pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : ieee80211_free_ack_frame+0x5c/0x90 [mac80211] lr : ieee80211_free_ack_frame+0x5c/0x90 [mac80211] sp : ffff80008c1b37b0 x29: ffff80008c1b37b0 x28: ffff000003be8000 x27: 0000000000000000 x26: 0000000000000000 x25: ffff000003dc14b8 x24: ffff80008c1b37d0 x23: ffff000000ff9f80 x22: 0000000000000000 x21: 000000007fffffff x20: ffff80007c7e93d8 x19: ffff00006e66f400 x18: 0000000000000000 x17: ffff7ffffd2b3000 x16: ffff800083fc0000 x15: 0000000000000000 x14: 0000000000000000 x13: 2173656d61726620 x12: 6b636120676e6964 x11: 000000000000000 x10: 000000000000005d x9: ffff8000802af2b0 x8: ffff80008c1b3430 x7: 00000000000000001 x6 : 0000000000000001 x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000 x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff000003be8000 Rastreo de llamadas: ieee80211_free_ack_frame+0x5c/0x90 [mac80211] idr_for_each+0x74/0x110 ieee80211_free_hw+0x44/0xe8 [mac80211] rtw_sdio_remove+0x9c/0xc0 [rtw88_sdio] sdio_bus_remove+0x44/0x180 device_remove+0x54/0x90 device_release_driver_internal+0x1d4/0x238 driver_detach+0x54/0xc0 bus_remove_driver+0x78/0x108 driver_unregister+0x38/0x78 sdio_unregister_driver+0x2c/0x40 rtw_8723cs_driver_exit+0x18/0x1000 [rtw88_8723cs] __do_sys_delete_module.isra.0+0x190/0x338 __arm64_sys_delete_module+0x1c/0x30 invocar_llamada_al_sistema+0x74/0x100 el0_svc_common.constprop.0+0x48/0xf0 do_el0_svc+0x24/0x38 el0_svc+0x3c/0x158 el0t_64_sync_handler+0x120/0x138 el0t_64_sync+0x194/0x198 ---[ fin de seguimiento 0000000000000000 ]---\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/wireless/realtek/rtw88/sdio.c\",\"drivers/net/wireless/realtek/rtw88/usb.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"e3037485c68ec1a299ff41160d8fedbd4abc29b9\",\"lessThan\":\"4e8ce3978d704cb28678355d294e10a008b6230a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e3037485c68ec1a299ff41160d8fedbd4abc29b9\",\"lessThan\":\"3d94c4b21966b49c3e26ceeefacaa11ff7ee6d68\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e3037485c68ec1a299ff41160d8fedbd4abc29b9\",\"lessThan\":\"9bca6528f20325d30c22236b23116f161d418f6d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e3037485c68ec1a299ff41160d8fedbd4abc29b9\",\"lessThan\":\"3e5e4a801aaf4283390cc34959c6c48f910ca5ea\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/wireless/realtek/rtw88/sdio.c\",\"drivers/net/wireless/realtek/rtw88/usb.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.2\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.2\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.136\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.70\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.5\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.13\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.2\",\"versionEndExcluding\":\"6.1.136\",\"matchCriteriaId\":\"863DB97A-FEBB-437F-B15E-8D41C1CCDE93\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.70\",\"matchCriteriaId\":\"51E6CFF2-92AA-4936-95AB-2D068168A696\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.5\",\"matchCriteriaId\":\"9501D045-7A94-42CA-8B03-821BE94A65B7\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/3d94c4b21966b49c3e26ceeefacaa11ff7ee6d68\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3e5e4a801aaf4283390cc34959c6c48f910ca5ea\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4e8ce3978d704cb28678355d294e10a008b6230a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9bca6528f20325d30c22236b23116f161d418f6d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2025-11-21T10:43:03+00:00",
      "cve": "CVE-2024-56609",
      "id": "CVE-2024-56609",
      "initial_release_date": "2024-12-27T00:00:00+00:00",
      "product_status:known_affected": "108",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: wifi: rtw88: use ieee80211_purge_tx_queue() to purge TX skb",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-56609.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-11T02:06:53Z",
      "cve": "CVE-2024-56609",
      "id": "CVE-2024-56609",
      "initial_release_date": "2025-01-08T00:20:54Z",
      "product_status:known_affected": "410",
      "product_status:known_not_affected": "512",
      "product_status:recommended": "358",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-56609",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-56609.json",
      "version": "63"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.