--- cve: "CVE-2024-26896" severity: "LOW" cvss: 3.1 epss: "23%" vendor: "Linux" kev: false exploited: false published: "2024-04-17 11:15:10" tags: [cve, security, low] source: tsecurity.de CVE-Dossier exported: "2026-09-17T00:42:48+02:00" --- # CVE-2024-26896 > 3.1 LOW ## Beschreibung In the Linux kernel, the following vulnerability has been resolved: wifi: wfx: fix memory leak when starting AP Kmemleak reported this error: unreferenced object 0xd73d1180 (size 184): comm "wpa_supplicant", pid 1559, jiffies 13006305 (age 964.245s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 1e 00 01 00 00 00 00 00 ................ backtrace: [] kmem_cache_alloc+0x20c/0x5ac [] __alloc_skb+0x144/0x170 [] __netdev_alloc_skb+0x50/0x180 [] __ieee80211_beacon_get+0x290/0x4d4 [mac80211] [] ieee80211_beacon_get_tim+0x54/0x18c [mac80211] [] wfx_start_ap+0xc8/0x234 [wfx] [] ieee80211_start_ap+0x404/0x6b4 [mac80211] [] nl80211_start_ap+0x76c/0x9e0 [cfg80211] [] genl_rcv_msg+0x198/0x378 [] netlink_rcv_skb+0xd0/0x130 [] genl_rcv+0x34/0x44 [] netlink_unicast+0x1b4/0x258 [] netlink_sendmsg+0x1e8/0x428 [] ____sys_sendmsg+0x1e0/0x274 [] ___sys_sendmsg+0x80/0xb4 [] __sys_sendmsg+0x64/0xa8 unreferenced object 0xce087000 (size 1024): comm "wpa_supplicant", pid 1559, jiffies 13006305 (age 964.246s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 10 00 07 40 00 00 00 00 00 00 00 00 00 00 00 00 ...@............ backtrace: [] __kmalloc_track_caller+0x230/0x600 [] kmalloc_reserve.constprop.0+0x30/0x74 [] __alloc_skb+0xa0/0x170 [] __netdev_alloc_skb+0x50/0x180 [] __ieee80211_beacon_get+0x290/0x4d4 [mac80211] [] ieee80211_beacon_get_tim+0x54/0x18c [mac80211] [] wfx_start_ap+0xc8/0x234 [wfx] [] ieee80211_start_ap+0x404/0x6b4 [mac80211] [] nl80211_start_ap+0x76c/0x9e0 [cfg80211] [] genl_rcv_msg+0x198/0x378 [] netlink_rcv_skb+0xd0/0x130 [] genl_rcv+0x34/0x44 [] netlink_unicast+0x1b4/0x258 [] netlink_sendmsg+0x1e8/0x428 [] ____sys_sendmsg+0x1e0/0x274 [] ___sys_sendmsg+0x80/0xb4 However, since the kernel is build optimized, it seems the stack is not accurate. It appears the issue is related to wfx_set_mfp_ap(). The issue is obvious in this function: memory allocated by ieee80211_beacon_get() is never released. Fixing this leak makes kmemleak happy. ## Patch verfügbar (OSV) - Kernel ≥ 6.1.83 - Kernel ≥ 6.6.23 - Kernel ≥ 6.7.11 - Kernel ≥ 6.8.2 ## Referenzen - - - - - --- _Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2024-26896) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_