VYPR
← All advisories
High severity7.8NVD Advisory· Published Mar 6, 2025· Updated May 12, 2026

CVE-2024-58072

CVE-2024-58072

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: rtlwifi: remove unused check_buddy_priv

Commit 2461c7d60f9f ("rtlwifi: Update header file") introduced a global list of private data structures.

Later on, commit 26634c4b1868 ("rtlwifi Modify existing bits to match vendor version 2013.02.07") started adding the private data to that list at probe time and added a hook, check_buddy_priv to find the private data from a similar device.

However, that function was never used.

Besides, though there is a lock for that list, it is never used. And when the probe fails, the private data is never removed from the list. This would cause a second probe to access freed memory.

Remove the unused hook, structures and members, which will prevent the potential race condition on the list and its corruption during a second probe when probe fails.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

CVE-2024-58072 removes an unused rtlwifi list and its lock, fixing a potential use-after-free when probe fails and a second probe occurs.

Vulnerability

Analysis

CVE-2024-58072 addresses a memory-safety issue in the Linux kernel's rtlwifi driver (Realtek wireless LAN). The vulnerability exists because a global list of private data structures was introduced in commit 2461c7d60f9f and later populated at probe time via a check_buddy_priv function, but that function was never actually called. Crucially, a failed probe does not remove the corresponding private data from this list, and while a lock protects the list, it is never used. If the driver probes again (e.g., after a hardware reset or module reload), it will walk a list containing stale pointers, leading to use-after-free on freed memory [1].

Exploitation & Impact

To trigger this issue, an attacker would need to cause the rtlwifi driver to fail during probe and then be probed again. In a system with the affected kernel, a malicious USB device or a hardware state change that forces re-probing could induce the race. No authentication is required on a local system if the attacker has physical or logical access to trigger the probe. The impact is a use-after-free that can result in memory corruption, potentially leading to a system crash (denial of service) or arbitrary code execution with kernel privileges. The CVSS v3 score is 7.8 (High), reflecting the high severity of local privilege escalation or system compromise [1].

Mitigation

The fix, merged into the Linux kernel stable tree, removes the unused check_buddy_priv hook, the global list, its lock, and the associated private data members. Commits in the stable branches (e.g., 8e2fcc68fbaa, 1b9cbd8a9ae6, 543e3e9f2e9e) eliminate the vulnerable structures entirely. Users are advised to update to a kernel version containing these fixes. Siemens has also listed this CVE as affecting the SIMATIC S7-1500 TM MFP - GNU/Linux subsystem in its advisory SSA-265688, meaning that embedded/industrial users must apply the corresponding kernel updates [1]. No workarounds are provided beyond applying the patch.

References
  1. SSA-265688

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

147

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

11

News mentions

0

No linked articles in our index yet.