CVE-2024-35789

Q: What is the severity of CVE-2024-35789?

CVE-2024-35789 has a CVSS score of 7.8 (HIGH). This CVE describes a use-after-free vulnerability in the Linux kernel's WiFi subsystem (mac80211). When a station is moved out of a VLAN and the VLAN is deleted, the fast_rx entry retains a pointer to the freed VLAN network device, potentially causing kernel crashes or code execution. This affects Linux systems using the mac80211 WiFi stack with VLAN configurations.

7.8 HIGH

Denial of Service

📋 TL;DR

This CVE describes a use-after-free vulnerability in the Linux kernel's WiFi subsystem (mac80211). When a station is moved out of a VLAN and the VLAN is deleted, the fast_rx entry retains a pointer to the freed VLAN network device, potentially causing kernel crashes or code execution. This affects Linux systems using the mac80211 WiFi stack with VLAN configurations.

💻 Affected Systems

Products:

Linux kernel

Versions: Specific affected versions not explicitly listed in CVE, but patches are available in stable kernel trees. Likely affects recent kernel versions before fixes were backported.

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ✅ No

Notes: Only affects systems using mac80211 WiFi stack with VLAN configurations where stations are moved between VLANs.

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic leading to system crash, or potential arbitrary code execution with kernel privileges resulting in complete system compromise.

🟠

Likely Case

System instability, kernel crashes, or denial of service affecting WiFi connectivity on affected systems.

🟢

If Mitigated

Minimal impact if VLAN features are not used or systems are properly patched.

🌐 Internet-Facing: LOW - Requires local network access and specific VLAN configuration changes.

🏢 Internal Only: MEDIUM - Could be exploited by authenticated users on the local network with VLAN management privileges.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Exploitation requires local network access and ability to manipulate VLAN configurations. The vulnerability is in kernel memory management.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Patches available in stable kernel trees via the provided git commits

Vendor Advisory: https://git.kernel.org/stable/c/2884a50f52313a7a911de3afcad065ddbb3d78fc

Restart Required: Yes

Instructions:

1. Update Linux kernel to a version containing the fix. 2. Check your distribution's security advisories for specific patched versions. 3. Reboot system after kernel update.

🔧 Temporary Workarounds

Disable VLAN features

linux

Avoid using VLAN configurations for WiFi stations if not required

Restrict VLAN management

all

Limit VLAN configuration changes to trusted administrators only

🧯 If You Can't Patch

Implement strict access controls for VLAN configuration management
Monitor systems for kernel panics or unusual WiFi subsystem behavior

🔍 How to Verify

Check if Vulnerable:

Check kernel version and compare with distribution's security advisories. Vulnerable if using unpatched kernel with mac80211 VLAN support.

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version includes one of the fix commits: 2884a50f52313a7a911de3afcad065ddbb3d78fc or other listed commits.

📡 Detection & Monitoring

Log Indicators:

Kernel panic logs
mac80211 subsystem errors
VLAN configuration change logs

Network Indicators:

Unexpected WiFi disconnections
VLAN configuration anomalies

SIEM Query:

Search for kernel panic events or mac80211 subsystem errors in system logs

📊 Metadata

CVE ID: CVE-2024-35789

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-416

Published: May 17, 2024

Last Updated: December 23, 2025

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Debian Linux by Debian

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Disable VLAN features

Restrict VLAN management

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export

🔗 Related Vulnerabilities