VYPR
← All advisories
High severity7.8NVD Advisory· Published Oct 21, 2024· Updated May 12, 2026

CVE-2024-47718

CVE-2024-47718

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: rtw88: always wait for both firmware loading attempts

In 'rtw_wait_firmware_completion()', always wait for both (regular and wowlan) firmware loading attempts. Otherwise if 'rtw_usb_intf_init()' has failed in 'rtw_usb_probe()', 'rtw_usb_disconnect()' may issue 'ieee80211_free_hw()' when one of 'rtw_load_firmware_cb()' (usually the wowlan one) is still in progress, causing UAF detected by KASAN.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

In the Linux kernel's rtw88 driver, a race condition can cause use-after-free when firmware loading is interrupted by device disconnect.

Vulnerability

Overview

CVE-2024-47718 is a race condition vulnerability in the Linux kernel's Realtek rtw88 Wi-Fi driver. The flaw resides in the function rtw_wait_firmware_completion(), which fails to wait for both the regular and WoWLAN (Wake-on-WLAN) firmware loading attempts to complete before proceeding. If rtw_usb_intf_init() fails during rtw_usb_probe(), the rtw_usb_disconnect() path may call ieee80211_free_hw() while a firmware loading callback (typically the WoWLAN one) is still in progress. This race condition leads to a use-after-free (UAF) condition, as detected by the Kernel Address Sanitizer (KASAN) [1][2].

Attack

Vector and Exploitation

The vulnerability is exploitable locally, requiring physical or logical access to a system using a Realtek USB Wi-Fi adapter (rtw88 driver). An attacker could trigger the race by causing the device to be disconnected while the driver is still loading firmware. The attack vector is local, with low attack complexity, low privileges required, and no user interaction needed for exploitation. A successful exploit would allow an attacker with local access to trigger a use-after-free, potentially leading to system crashes or arbitrary code execution [1].

Impact and

Mitigation

The consequence of this vulnerability is a high-severity use-after-free condition, which can compromise system integrity by causing a denial of service (system crash) or potentially allowing privilege escalation from a local attacker. The CVSS v3 base score is 7.8 (High) [1]. The issue is addressed by ensuring that rtw_wait_firmware_completion() always waits for both firmware loading attempts to complete, as implemented in commits to the Linux kernel stable branches [3][4]. Users should apply the latest kernel updates to mitigate this vulnerability.

References
  1. SSA-265688
  2. SSA-355557
  3. Making sure you're not a bot!
  4. Making sure you're not a bot!

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

106

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

11

News mentions

0

No linked articles in our index yet.