8.8

CVE-2024-26779: wifi: mac80211: fix race condition on enabling fast-xmit

Modified
AliasesUBUNTU-CVE-2024-26779DEBIAN-CVE-2024-26779
Published 03-04-2024Last modified 05-08-2026

Vulnerability summary

CVE-2024-26779 is a high (CVSS 8.8) vulnerability in debian debian_linux. EPSS estimates a 0.28% chance of exploitation in the next 30 days, higher than 20.7% of scored vulnerabilities.

Priority
Routine

Not severe (CVSS 8.8, adjacent network); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
8.8/10
010
High · v3.1 (CVE.org)
EPSS score
0.28%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 25 · Related 19
DLA-3840-1DLA-3842-1DSA-5681-1RHSA-2024:3618RHSA-2024:3627RHSA-2025:3935

Timeline

  1. 03-04-2024
    PublishedVulnerability first disclosed.
  2. 05-08-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix race condition on enabling fast-xmit fast-xmit must only be enabled after the sta has been uploaded to the driver, otherwise it could end up passing the not-yet-uploaded sta via drv_tx calls to the driver, leading to potential crashes because of uninitialized drv_priv data. Add a missing sta->uploaded check and re-check fast xmit after inserting a sta.

CVSS metrics

5 scores · 4 sources · 2 versions

EPSS trend

Probability

0.28%

Chance of exploitation in the next 30 days

Percentile

21%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.28% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: adjacent network, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Ubuntu117 products
  • linuxAll versions (No fix recorded) | < 5.4.0-186.206 | < 5.15.0-112.122
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded) | < 5.4.0-1126.136 | < 5.15.0-1063.69
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Debian2 products
Linux2 products
  • linux≥ 17c18bf880b2464851e5a2bca86521affc46c97e, < 76fad1174a0cae6fc857b9f88b261a2e4f07d587 | ≥ 17c18bf880b2464851e5a2bca86521affc46c97e, < 85720b69aef177318f4a18efbcc4302228a340e5 | ≥ 17c18bf880b2464851e5a2bca86521affc46c97e, < 5ffab99e070b9f8ae0cf60c3c3602b84eee818dd | ≥ 17c18bf880b2464851e5a2bca86521affc46c97e, < 88c18fd06608b3adee547102505d715f21075c9d | ≥ 17c18bf880b2464851e5a2bca86521affc46c97e, < eb39bb548bf974acad7bd6780fe11f9e6652d696 | ≥ 17c18bf880b2464851e5a2bca86521affc46c97e, < 54b79d8786964e2f840e8a2ec4a9f9a50f3d4954 | ≥ 17c18bf880b2464851e5a2bca86521affc46c97e, < 281280276b70c822f55ce15b661f6d1d3228aaa9 | ≥ 17c18bf880b2464851e5a2bca86521affc46c97e, < bcbc84af1183c8cf3d1ca9b78540c2185cd85e7f | 4.2
  • linux_kernel< 4.19.308 | ≥ 4.20, < 5.4.270 | ≥ 5.5, < 5.10.211 | ≥ 5.11, < 5.15.150 | ≥ 5.16, < 6.1.80 | ≥ 6.2, < 6.6.19 | ≥ 6.7, < 6.7.7 | 6.8:rc1

3 vendors · 121 products

References

26 links
Show all 26 references