VYPR
← All advisories
Medium severity5.5NVD Advisory· Published Oct 21, 2024· Updated May 12, 2026

CVE-2024-50008

CVE-2024-50008

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_cmd_802_11_scan_ext()

Replace one-element array with a flexible-array member in struct host_cmd_ds_802_11_scan_ext.

With this, fix the following warning:

elo 16 17:51:58 surfacebook kernel: ------------[ cut here ]------------ elo 16 17:51:58 surfacebook kernel: memcpy: detected field-spanning write (size 243) of single field "ext_scan->tlv_buffer" at drivers/net/wireless/marvell/mwifiex/scan.c:2239 (size 1) elo 16 17:51:58 surfacebook kernel: WARNING: CPU: 0 PID: 498 at drivers/net/wireless/marvell/mwifiex/scan.c:2239 mwifiex_cmd_802_11_scan_ext+0x83/0x90 [mwifiex]

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A memcpy field-spanning write warning in the mwifiex wireless driver's scan command handler could lead to memory corruption; fixing by replacing a one-element array with a flexible-array member.

What the vulnerability is

The host_cmd_ds_802_11_scan_ext structure in the mwifiex driver contained a one-element array tlv_buffer intended for variable-length data. In mwifiex_cmd_802_11_scan_ext, a memcpy writes up to 243 bytes into this field, but since the array is declared as size 1, the compiler's fortified memcpy detects a field-spanning write and triggers a warning. This is a root-cause issue where the data structure does not accurately represent the intended memory layout.

How it is exploited

An attacker with local access and the ability to trigger a scan operation (likely requiring some privileges) can cause the kernel to emit a WARN_ON. If the kernel is configured to panic on warnings, this can lead to a denial of service. The warning occurs in the Marvell mwifiex driver, commonly used in Wi-Fi adapters. No authentication over the network is needed; local access is sufficient.

Impact

While the immediate effect is a kernel warning, the underlying issue could allow memory corruption if the memcpy writes beyond the intended buffer. The fortified memcpy detects the overflow and prevents corruption, but the warning itself may cause system instability or crash if panic-on-warn is enabled. The vulnerability has a CVSS v3 score of 5.5 (Medium) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, indicating a local denial-of-service impact.

Mitigation

The fix replaces the one-element array with a flexible-array member (zero-length array in C99), allowing the compiler to properly track the array size and eliminate the false positive warning. This fix has been committed to the Linux kernel stable tree (commits [3] and [4]). Users should apply the latest kernel updates to address this issue.

References
  1. Making sure you're not a bot!
  2. Making sure you're not a bot!

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

105

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

13

News mentions

0

No linked articles in our index yet.