CVE-2024-57948 – A race condition vulnerability in the Linux ker... (How to Fix)

Q: What is the severity of CVE-2024-57948?

CVE-2024-57948 has a CVSS score of 5.5 (MEDIUM). A race condition vulnerability in the Linux kernel's IEEE 802.15.4 (WPAN) subsystem allows a local attacker to cause a kernel panic (denial of service) by removing a network interface while hardware is being unregistered. This affects systems using IEEE 802.15.4 wireless interfaces, primarily IoT and embedded Linux devices.

📋 TL;DR

A race condition vulnerability in the Linux kernel's IEEE 802.15.4 (WPAN) subsystem allows a local attacker to cause a kernel panic (denial of service) by removing a network interface while hardware is being unregistered. This affects systems using IEEE 802.15.4 wireless interfaces, primarily IoT and embedded Linux devices.

💻 Affected Systems

Products:

Linux kernel

Versions: Specific affected versions not explicitly stated, but references indicate fixes in stable kernel trees. Likely affects versions before the fix commits.

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects systems with IEEE 802.15.4 (WPAN) hardware/drivers enabled. Many standard desktop/server systems may not be vulnerable unless using specific wireless hardware.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic leading to system crash and denial of service, requiring physical or remote reboot.

🟠

Likely Case

System instability or crash when IEEE 802.15.4 interfaces are being removed or hardware is unregistered.

🟢

If Mitigated

No impact if proper access controls prevent unprivileged users from manipulating network interfaces.

🌐 Internet-Facing: LOW - Requires local access to trigger the race condition.

🏢 Internal Only: MEDIUM - Local attackers or misconfigured services could trigger the vulnerability, causing system instability.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM - Requires local access and precise timing to trigger race condition.

Discovered via syzkaller fuzzing. Exploitation requires local access and ability to manipulate network interfaces.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Fixed in stable kernel commits: 0d11dc30edfc4acef0acef130bb5ca596317190a, 2e41e98c4e79edae338f2662dbdf74ac2245d183, 41e4ca8acba39f1cecff2dfdf14ace4ee52c4272, 80aee0bc0dbe253b6692d33e64455dc742fc52f1, 98ea165a2ac240345c48b57c0a3d08bbcad02929

Vendor Advisory: https://git.kernel.org/stable/c/0d11dc30edfc4acef0acef130bb5ca596317190a

Restart Required: Yes

Instructions:

1. Update Linux kernel to version containing the fix commits. 2. Reboot system to load new kernel.

🔧 Temporary Workarounds

Disable IEEE 802.15.4 subsystem

linux

Remove or disable IEEE 802.15.4 hardware/drivers if not needed.

modprobe -r mac802154
modprobe -r ieee802154

Restrict interface manipulation

linux

Use Linux capabilities or SELinux/AppArmor to prevent unprivileged users from adding/removing network interfaces.

🧯 If You Can't Patch

Ensure only trusted users have CAP_NET_ADMIN capability to manipulate network interfaces.
Monitor system logs for kernel panic messages related to list corruption in ieee802154_if_remove.

🔍 How to Verify

Check if Vulnerable:

Check if IEEE 802.15.4 modules are loaded: lsmod | grep -E 'mac802154|ieee802154'. If loaded and kernel version predates fix commits, system may be vulnerable.

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version includes one of the fix commits: grep -r 'check local interfaces before deleting sdata list' /usr/src/linux-source-*/net/mac802154/iface.c

📡 Detection & Monitoring

Log Indicators:

Kernel panic messages containing 'list_del_entry_valid_or_report'
BUG at lib/list_debug.c
ieee802154_if_remove in stack traces

Network Indicators:

Unusual IEEE 802.15.4 interface removal activity

SIEM Query:

source="kernel" AND ("list_del_entry_valid_or_report" OR "ieee802154_if_remove" OR "kernel BUG at lib/list_debug.c")

📊 Metadata

CVE ID: CVE-2024-57948

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-476

Published: January 31, 2025

Last Updated: November 3, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-57948, you might also want to check these: