VYPR
← All advisories
High severity7.8NVD Advisory· Published May 17, 2024· Updated May 12, 2026

CVE-2024-35789

CVE-2024-35789

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes

When moving a station out of a VLAN and deleting the VLAN afterwards, the fast_rx entry still holds a pointer to the VLAN's netdev, which can cause use-after-free bugs. Fix this by immediately calling ieee80211_check_fast_rx after the VLAN change.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

In the Linux kernel, a use-after-free in mac80211 can occur when moving a station out of a VLAN and deleting the VLAN, due to a lingering fast_rx pointer.

Vulnerability

CVE-2024-35789 is a use-after-free vulnerability in the Linux kernel's mac80211 subsystem. The bug occurs when a Wi-Fi station is moved out of a VLAN (Virtual Local Area Network) and that VLAN is subsequently deleted. The fast_rx data structure, used for fast-path receive processing, retains a pointer to the VLAN's network device (netdev) even after the station's VLAN membership changes. This dangling pointer leads to a use-after-free condition when memory associated with the deleted VLAN is reused, potentially causing a crash or arbitrary code execution [1][2].

Attack

Vector

To exploit this vulnerability, an attacker would need to have the ability to perform specific VLAN configuration operations on a system running a vulnerable Linux kernel. This includes moving a station out of a non-4-address VLAN and then deleting that VLAN. The attack requires local access to the system (CVSS v3 score 7.8, High), as it involves manipulating network interface and wireless subsystem settings. No authentication is explicitly required beyond the ability to execute privileged commands to manage VLANs and stations [1].

Impact

Successful exploitation could allow an attacker to trigger a use-after-free, which may lead to system instability (crash) or potentially gain elevated privileges and execute arbitrary code in the kernel context. Given the high severity score, the vulnerability poses a significant risk to systems where untrusted users have administrative capabilities over VLAN configurations [1][2].

Mitigation

The vulnerability is fixed in the Linux kernel by immediately calling ieee80211_check_fast_rx after a VLAN change operation to invalidate any stale fast_rx entries [1][2][3][4]. The fix must be applied by updating the kernel to a version that includes the appropriate commit. Siemens has confirmed that the affected product SIMATIC S7-1500 TM MFP - GNU/Linux subsystem is affected and should be updated accordingly [1].

References
  1. SSA-265688
  2. Making sure you're not a bot!
  3. Making sure you're not a bot!
  4. Making sure you're not a bot!

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

314

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

12

News mentions

0

No linked articles in our index yet.