CVE-2024-56609: wifi: rtw88: use ieee80211_purge_tx_queue() to purge TX skb
In the Linux kernel, the following vulnerability has been resolved:
wifi: rtw88: use ieee80211purgetxqueue() to purge TX skb
When removing kernel modules by: rmmod rtw888723cs rtw888703b rtw888723x rtw88sdio rtw88core
Driver uses skbqueuepurge() to purge TX skb, but not report tx status causing "Have pending ack frames!" warning. Use ieee80211purgetxqueue() to correct this.
Since ieee80211purgetxqueue() doesn't take locks, to prevent racing between TX work and purge TX queue, flush and destroy TX work in advance.
wlan0: deauthenticating from aa:f5:fd:60:4c:a8 by local choice (Reason: 3=DEAUTHLEAVING) ------------[ cut here ]------------ Have pending ack frames! WARNING: CPU: 3 PID: 9232 at net/mac80211/main.c:1691 ieee80211freeackframe+0x5c/0x90 [mac80211] CPU: 3 PID: 9232 Comm: rmmod Tainted: G C 6.10.1-200.fc40.aarch64 #1 Hardware name: pine64 Pine64 PinePhone Braveheart (1.1)/Pine64 PinePhone Braveheart (1.1), BIOS 2024.01 01/01/2024 pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : ieee80211freeackframe+0x5c/0x90 [mac80211] lr : ieee80211freeackframe+0x5c/0x90 [mac80211] sp : ffff80008c1b37b0 x29: ffff80008c1b37b0 x28: ffff000003be8000 x27: 0000000000000000 x26: 0000000000000000 x25: ffff000003dc14b8 x24: ffff80008c1b37d0 x23: ffff000000ff9f80 x22: 0000000000000000 x21: 000000007fffffff x20: ffff80007c7e93d8 x19: ffff00006e66f400 x18: 0000000000000000 x17: ffff7ffffd2b3000 x16: ffff800083fc0000 x15: 0000000000000000 x14: 0000000000000000 x13: 2173656d61726620 x12: 6b636120676e6964 x11: 0000000000000000 x10: 000000000000005d x9 : ffff8000802af2b0 x8 : ffff80008c1b3430 x7 : 0000000000000001 x6 : 0000000000000001 x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000 x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff000003be8000 Call trace: ieee80211freeackframe+0x5c/0x90 [mac80211] idrforeach+0x74/0x110 ieee80211freehw+0x44/0xe8 [mac80211] rtwsdioremove+0x9c/0xc0 [rtw88sdio] sdiobusremove+0x44/0x180 deviceremove+0x54/0x90 devicereleasedriverinternal+0x1d4/0x238 driverdetach+0x54/0xc0 busremovedriver+0x78/0x108 driverunregister+0x38/0x78 sdiounregisterdriver+0x2c/0x40 rtw8723csdriverexit+0x18/0x1000 [rtw888723cs] dosysdeletemodule.isra.0+0x190/0x338 arm64sysdeletemodule+0x1c/0x30 invokesyscall+0x74/0x100 el0svccommon.constprop.0+0x48/0xf0 doel0svc+0x24/0x38 el0svc+0x3c/0x158 el0t64synchandler+0x120/0x138 el0t64sync+0x194/0x198 ---[ end trace 0000000000000000 ]---
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-56609?
The severity of CVE-2024-56609 has not been explicitly classified but it affects the Linux kernel's handling of TX skb during module removals.
How do I fix CVE-2024-56609?
To fix CVE-2024-56609, ensure your Linux kernel and rtw88 drivers are updated to the latest patched versions.
What systems are affected by CVE-2024-56609?
CVE-2024-56609 affects systems running the Linux kernel and specifically the rtw88 wireless drivers.
What happens if I don't address CVE-2024-56609?
Failing to address CVE-2024-56609 may lead to instability or unexpected behavior when unloading certain wireless kernel modules.
Is CVE-2024-56609 specific to certain Linux distributions?
CVE-2024-56609 is not specific to any Linux distribution; it affects the Linux kernel across multiple distributions using the rtw88 drivers.