{"id":"DEBIAN-CVE-2024-40911","details":"In the Linux kernel, the following vulnerability has been resolved:  wifi: cfg80211: Lock wiphy in cfg80211_get_station  Wiphy should be locked before calling rdev_get_station() (see lockdep assert in ieee80211_get_station()).  This fixes the following kernel NULL dereference:   Unable to handle kernel NULL pointer dereference at virtual address 0000000000000050  Mem abort info:    ESR = 0x0000000096000006    EC = 0x25: DABT (current EL), IL = 32 bits    SET = 0, FnV = 0    EA = 0, S1PTW = 0    FSC = 0x06: level 2 translation fault  Data abort info:    ISV = 0, ISS = 0x00000006    CM = 0, WnR = 0  user pgtable: 4k pages, 48-bit VAs, pgdp=0000000003001000  [0000000000000050] pgd=0800000002dca003, p4d=0800000002dca003, pud=08000000028e9003, pmd=0000000000000000  Internal error: Oops: 0000000096000006 [#1] SMP  Modules linked in: netconsole dwc3_meson_g12a dwc3_of_simple dwc3 ip_gre gre ath10k_pci ath10k_core ath9k ath9k_common ath9k_hw ath  CPU: 0 PID: 1091 Comm: kworker/u8:0 Not tainted 6.4.0-02144-g565f9a3a7911-dirty #705  Hardware name: RPT (r1) (DT)  Workqueue: bat_events batadv_v_elp_throughput_metric_update  pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)  pc : ath10k_sta_statistics+0x10/0x2dc [ath10k_core]  lr : sta_set_sinfo+0xcc/0xbd4  sp : ffff000007b43ad0  x29: ffff000007b43ad0 x28: ffff0000071fa900 x27: ffff00000294ca98  x26: ffff000006830880 x25: ffff000006830880 x24: ffff00000294c000  x23: 0000000000000001 x22: ffff000007b43c90 x21: ffff800008898acc  x20: ffff00000294c6e8 x19: ffff000007b43c90 x18: 0000000000000000  x17: 445946354d552d78 x16: 62661f7200000000 x15: 57464f445946354d  x14: 0000000000000000 x13: 00000000000000e3 x12: d5f0acbcebea978e  x11: 00000000000000e3 x10: 000000010048fe41 x9 : 0000000000000000  x8 : ffff000007b43d90 x7 : 000000007a1e2125 x6 : 0000000000000000  x5 : ffff0000024e0900 x4 : ffff800000a0250c x3 : ffff000007b43c90  x2 : ffff00000294ca98 x1 : ffff000006831920 x0 : 0000000000000000  Call trace:   ath10k_sta_statistics+0x10/0x2dc [ath10k_core]   sta_set_sinfo+0xcc/0xbd4   ieee80211_get_station+0x2c/0x44   cfg80211_get_station+0x80/0x154   batadv_v_elp_get_throughput+0x138/0x1fc   batadv_v_elp_throughput_metric_update+0x1c/0xa4   process_one_work+0x1ec/0x414   worker_thread+0x70/0x46c   kthread+0xdc/0xe0   ret_from_fork+0x10/0x20  Code: a9bb7bfd 910003fd a90153f3 f9411c40 (f9402814)  This happens because STA has time to disconnect and reconnect before batadv_v_elp_throughput_metric_update() delayed work gets scheduled. In this situation, ath10k_sta_state() can be in the middle of resetting arsta data when the work queue get chance to be scheduled and ends up accessing it. Locking wiphy prevents that.","modified":"2026-09-15T09:03:09.455290356Z","published":"2024-07-12T13:15:14.283Z","upstream":["CVE-2024-40911"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2024-40911"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:12","purl":"pkg:deb/debian/linux?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.99-1"}]}],"versions":["6.1.27-1","6.1.37-1","6.1.38-1","6.1.38-2","6.1.38-2~bpo11+1","6.1.38-3","6.1.38-4","6.1.38-4~bpo11+1","6.1.52-1","6.1.55-1","6.1.55-1~bpo11+1","6.1.64-1","6.1.66-1","6.1.67-1","6.1.69-1","6.1.69-1~bpo11+1","6.1.76-1","6.1.76-1~bpo11+1","6.1.82-1","6.1.85-1","6.1.90-1","6.1.90-1~bpo11+1","6.1.94-1","6.1.94-1~bpo11+1","6.1.98-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2024-40911.json"}},{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.7-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2024-40911.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.7-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2024-40911.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}